Security audit

Swarm Coord

Security checks for vulnerabilities and agentic risk

Overview

This skill clearly describes a multi-agent coordination workflow, with disclosed session spawning and planning before execution, though users should review plans carefully before allowing side effects.

Install only if you want your agent to coordinate work across multiple sessions. Before approving a swarm plan, check which sub-agents will run, what files or services they may touch, and whether any step will send messages, push code, or persist task state.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README says complex tasks can 'automatically trigger' the skill from ordinary user requests, which creates ambiguous activation boundaries for a capability that can spawn multiple agents and coordinate parallel actions. In this context, unintended activation increases the chance of decomposing and executing user requests without an explicit, informed handoff to a high-impact orchestration workflow.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The listed trigger phrases include very generic terms like '协作', '分工', 'swarm', and 'team work', which are likely to appear in normal conversation unrelated to delegating execution. Because this skill can spawn sessions and coordinate downstream actions, broad phrase matching materially raises the risk of accidental invocation and unintended task dispatch.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The examples describe writing documents, committing and pushing code, and sending group notifications, but the README does not prominently warn users that the skill may cause external side effects across multiple systems. In a multi-agent orchestration skill, side effects are amplified because several actions may run in parallel, increasing the chance of unintended modifications or communications before the user fully understands the impact.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases include broad, common terms such as '协作', '分工', '团队任务', and 'team work', which can cause the skill to activate for ordinary requests that do not clearly require multi-agent orchestration. Overbroad activation increases the chance of unintended delegation, context spreading across sessions, and downstream execution of impactful actions without the user explicitly asking for orchestration.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The condition 'CEO 主动判断当前任务适合拆分' allows subjective agent discretion without concrete boundaries, making activation unpredictable and prone to overreach. In a coordination skill that can spawn sessions and distribute tasks, ambiguous activation logic is dangerous because it can expand the scope of action beyond what the user clearly authorized.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill showcases or permits external actions such as sending messages, pushing updates, and writing task state, but does not clearly warn the user that these actions may occur or require confirmation before execution. In this skill's context, the risk is elevated because multi-agent parallel execution can multiply the speed and scope of external side effects, making accidental or unauthorized actions more damaging.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 65% confidence
Finding: The document structures usage and trigger guidance around Chinese and English, including explicit trigger words for only those languages. This may amount to a language policy constraint without stating whether other languages are unsupported or whether users can opt into their preferred language.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.