Security audit

Swarm Coder Free

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed coding-workflow skill that uses local files and agent review steps, with no evidence of hidden exfiltration, destructive behavior, or deception.

Install only if you want a Chinese-language, subagent-driven coding workflow. Expect it to create local .swarm files and to guide agents through code changes, tests, reviews, and commits; review those files before committing them and invoke the skill explicitly for planned development work.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The quick-start instructions immediately create files under .swarm/ using shell redirection, which modifies the user's workspace before any explicit warning or confirmation. For a skill with exec access, this is dangerous because users may invoke or follow setup steps assuming they are informational, while the skill is actually directing persistent filesystem changes that can affect later agent behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill declares a very broad activation scope using generic software-development phrases and weak exclusion criteria, making it likely to trigger in contexts beyond its intended use. In an agent system with tool access, this can cause the skill to take over ordinary coding requests unexpectedly, steering workflow, reviews, and tool usage without the user clearly opting in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The license section explicitly states the skill is '完全中文化表达，适配中文用户工作流', indicating a fixed language/locale orientation. Elsewhere the document does not offer an opt-in language choice or explain that the skill is limited to a Chinese-specific compliance or regional context, so this creates a language-policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: All instructional content and embedded agent prompts in this file are presented in Chinese, which can impose a language requirement on users or downstream agents without opt-in. The file does not indicate that the skill is intentionally limited to a Chinese-language audience or provide any alternative language option.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 87% confidence
Finding: This duplicate finding points to the same persistence behavior: creating .swarm/prompts, reports, and logs and writing prompt files to disk. Persisting agent instructions and context on disk increases the chance of unintended disclosure, stale-state reuse, and repository contamination if the files are later committed or consumed by other tools.
Content: Scanner excerpt · references/detail.md (reported line 10)May include surrounding context.
bash
ls docs/plans/feature-plan.md 2>/dev/null && echo "检测到计划文件" mkdir -p .swarm/{prompts,reports,logs} cat > .swarm/prompts/implementer.md << 'EOF' 你是实现者子代理。你的任务是：

Session Persistence

Medium

Category: Rogue Agent
Confidence: 87% confidence
Finding: This duplicate finding points to the same persistence behavior: creating .swarm/prompts, reports, and logs and writing prompt files to disk. Persisting agent instructions and context on disk increases the chance of unintended disclosure, stale-state reuse, and repository contamination if the files are later committed or consumed by other tools.
Content: Scanner excerpt · references/detail.md (reported line 10)May include surrounding context.
bash
ls docs/plans/feature-plan.md 2>/dev/null && echo "检测到计划文件" mkdir -p .swarm/{prompts,reports,logs} cat > .swarm/prompts/implementer.md << 'EOF' 你是实现者子代理。你的任务是:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The example shell commands create directories and write prompt files into the workspace without an explicit safety notice or consent boundary. In an agent-skill context, users may copy or an agent may operationalize these commands, causing unintended persistent modification of the repository or working directory.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The implementer prompt at L028 states '不读取计划文件（控制器提供全文）', meaning the sub-agent should not read the plan file because the controller provides the full text. However, the documented workflow later explicitly includes '[读取计划文件：docs/plans/feature-plan.md]' at L115 and the diagram also begins with reading the plan file at L070-L071. This is an active contradiction between the documentation/prompted intent and the described behavior.
Content: No source excerpt is available for this finding.