SwarmClaw

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:27 AM UTC
• Version: 2.4.1

Overview

This skill is platform documentation for SwarmClaw and its broad capabilities are disclosed and aligned with that purpose, though installation and memory features deserve normal caution.

Before installing, verify the npm package publisher and consider pinning to the reviewed version. Configure credentials and connectors carefully, and make sure persistent memory, delegation, and outbound messaging are enabled only for agents that actually need them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23

Finding

Unpinned Global npm Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 23
Vulnerability Type: Supply-chain risk from an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code:

text

npm: `npm install -g swarmclaw`

Technical Analysis

The documented command installs the latest available version of the swarmclaw package from the configured npm registry without pinning an exact, reviewed version or verifying the package's integrity or signature. Because npm packages may define lifecycle scripts that execute during installation, following this command can run package-controlled code with the permissions of the installing user.

The use of the global installation option (-g) increases the potential scope because the package can modify globally shared npm locations and expose commands on the user's executable path. The repository provides no lockfile, checksum, signature, registry restriction, or publisher verification mechanism for the artifact obtained by this command.

Attack Path

1. An attacker compromises the npm package, its publisher account, or the associated release pipeline, or otherwise causes a malicious version to be served under the expected package name.
2. A user follows the documented npm install -g swarmclaw instruction.
3. npm resolves the mutable latest release rather than a previously reviewed exact version.
4. npm downloads and installs the attacker-controlled package.
5. Malicious npm lifecycle scripts can execute during installation with the installing user's privileges.
6. The compromised package can modify user-accessible files, install globally available commands, access data available to the installation process, or alter subsequent command execution.

Impact Assessment

Successful exploitation can provide arbitrary code execution with the privileges of the user running npm. The attacker could read or modify files accessible to that user, access environment varia ...[truncated 482 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installation instruction to an exact, reviewed version rather than resolving the latest release, for example:

   bash

   npm install -g swarmclaw@2.4.1
   

2. Document the expected npm registry and verified publisher identity to reduce dependency-confusion and registry-substitution risks.
3. Publish and document a cryptographic checksum, provenance attestation, or package-signature verification procedure for each supported release.
4. Prefer a project-local, lockfile-controlled installation over a global installation where operationally possible.
5. Use --ignore-scripts when lifecycle scripts are not required:

   bash

   npm install --ignore-scripts --save-exact swarmclaw@2.4.1
   

6. If lifecycle scripts are required, review them and the package contents before installation, and perform installation under a dedicated least-privileged account.
7. Establish a controlled upgrade process so that newer versions are reviewed and explicitly approved before the documented pin is updated.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

Manual dream trigger

Use the platform API to trigger a dream cycle:

json

{ "tool": "execute", "command": "curl -s -X POST http://localhost:3456/api/memory/dream -H 'Content-Type: application/json' -d '{\"agentId\":\"YOUR_AGENT_ID\"}'" }

Dream cycles produce dream_reflection and consolidated_insight memories that help maintain a clean, coherent memory store over time.

Static analysis

No suspicious patterns detected.