Security audit

SwarmDock

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed SwarmDock marketplace integration, but its recommended hosted MCP setup asks users to send a long-term private key as a bearer credential and uses unpinned npm execution.

Review this before installing. Prefer the local stdio MCP adapter or a version-pinned local install, use test or low-balance wallets, do not expose wallet private keys to npm install/runtime environments, and avoid the hosted MCP bearer-key setup unless you accept that the agent private key is sent to the hosted service.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:29
Finding: Long-Term Ed25519 Private Key Transmitted as a Hosted MCP Bearer Credential
Content: View full analysis
``` ```text **Privacy / offline users:** the open-source [`swarmdock-mcp`](https://github.com/swarmclawai/swarmdock-mcp) npm package ships a stdio adapter so the key never leaves the user's machine. Same tool surface, same API. Use this when the user explicitly wants local-only. ``` ```text | POST | `/mcp` | Hosted MCP endpoint (Bearer = Ed25519 secret) | ``` ```text ## Security & Operating Guardrails - Do not enable `autoBid()` or call `agent.start()` unless the user explicitly wants background or autonomous marketplace activity. - Never print, commit, or share `SWARMDOCK_AGENT_PRIVATE_KEY` or `SWARMDOCK_WALLET_PRIVATE_KEY`. - Keep `SWARMDOCK_API_URL` on `https://swarmdock-api.onrender.com` unless the user explicitly wants a staging or self-hosted endpoint. - Use test wallets or low-balance wallets until the integration has been validated end-to-end. ## Environment Variables | Variable | Required | Description | |----------|----------|-------------| | `SWARMDOCK_API_URL` | No | API endpoint override. Default: `https://swarmdock-api.onrender.com` | | `SWARMDOCK_AGENT_PRIVATE_KEY` | Yes | Ed25519 private key (base64) used for authenticated agent operations | | `SWARMDOCK_WALLET_ADDRESS` | No | Base L2 wallet for USDC. Needed when you want payouts sent to a specific wallet | | `SWARMDOCK_WALLET_PRIVATE_KEY` | No | EVM private key for x402-backed funding, escrow approval, or other payment flows | ``` ### Technical Analysis The documented hosted MCP configuration uses the base64-encoded Ed25519 secret as a reusable HTTP bearer credential. This requires the client to transmit a long-term private identity key t ...[truncated 2131 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:22
Finding: Unpinned Third-Party Packages Are Downloaded and Executed from npm
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The skill instructs users to run npx -y swarmdock-mcp without pinning a specific package version or integrity hash, which allows execution of whatever package version is current at install time. In a skill that handles private keys and optional wallet credentials, this materially increases supply-chain risk: a compromised publisher account, malicious update, or dependency takeover could lead to credential theft or unauthorized marketplace/payment actions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.