ClawHub
Back to skill

Security audit

agent-swarm-kit

Security checks across malware telemetry and agentic risk

Overview

This skill provides bounded guidance for setting up multi-agent OpenClaw teams and includes clear limits, secret-handling rules, verification, and teardown steps.

Before installing, be aware that this skill helps configure multiple agents and external message channels, so use it only when you are prepared to set explicit limits, restrict each agent's workspace and permissions, keep credentials in approved secret storage, and review any external posting, payment, publishing, or destructive action before it happens.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Unbounded Resource Access

Medium
Category
Excessive Agency
Content
authorization stated in the task contract.
9. Agents report evidence, changed artifacts, tests, and unresolved risks.
10. Agents stop when acceptance tests pass, a limit is reached, or the same
    blocker repeats. They do not loop indefinitely.
11. One writer owns a file at a time. Conflicting edits return to the
    orchestrator for integration.
12. Secrets stay in approved secret storage and never enter prompts or reports.
Confidence
75% confidence
Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.