ClawHub
Back to skill

Security audit

swarm-executor

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent multi-agent coordination skill with deployment and dependency cautions, but no evidence of hidden, destructive, or deceptive behavior.

Install as a coordination library, not as a hardened production control plane. Configure explicit max token limits if relying on budget enforcement, do not let untrusted agents choose privileged IDs like 001, and only run the compose stack after reviewing exposed ports, Redis/Grafana passwords, image pinning, and node-exporter host mounts.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (17)

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The code embeds a hidden authorization bypass by allowing canceller_id == "001" to cancel any negotiation regardless of normal ownership checks. In a multi-agent coordination system, hard-coded privileged identities are dangerous because they are undocumented, difficult to audit, and can be abused if agent IDs are spoofable or if callers can invoke this method with arbitrary IDs.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The code documents percentage-based tier quotas but does not actually enforce them when max_tokens is unset; can_use() returns true in that case, so the configured percentages are effectively informational only. In a swarm coordinator, this can break budget isolation and allow a high-cost tier to consume unlimited tokens, causing quota bypass, cost overruns, and degraded service behavior rather than direct code execution.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The node-exporter service mounts sensitive host filesystems (/proc, /sys, and /) read-only into the container, which exposes broad host telemetry and filesystem metadata to that service. While common for infrastructure monitoring, this exceeds the core swarm-coordination function and increases blast radius if the container, image, or exposed metrics endpoint is compromised.

Unpinned Dependencies

Low
Category
Supply Chain
Content
redis>=4.5.0
jsonschema>=4.17.0
pydantic>=2.0.0
fastapi>=0.104.0
Confidence
97% confidence
Finding
The dependency is specified with only a lower bound, so future installs may pull in different versions over time, reducing build reproducibility and making it easier for newly introduced vulnerable or breaking releases to enter the environment unnoticed. In a coordination/orchestration skill that may be deployed across multiple agents or services, inconsistent dependency resolution can amplify operational and security risk.

Unpinned Dependencies

Low
Category
Supply Chain
Content
redis>=4.5.0
jsonschema>=4.17.0
pydantic>=2.0.0
fastapi>=0.104.0
uvicorn>=0.24.0
Confidence
97% confidence
Finding
Using an unpinned jsonschema version makes builds non-reproducible and can silently introduce vulnerable or incompatible upstream changes. While not an exploit by itself, it weakens supply-chain control and makes secure deployment harder to guarantee.

Unpinned Dependencies

Low
Category
Supply Chain
Content
redis>=4.5.0
jsonschema>=4.17.0
pydantic>=2.0.0
fastapi>=0.104.0
uvicorn>=0.24.0
python-dotenv>=1.0.0
Confidence
98% confidence
Finding
An unpinned pydantic dependency is particularly risky because this package processes untrusted input in many Python services, and version drift can change validation behavior or introduce vulnerable releases. The swarm-coordinator context likely handles agent messages and schemas, so dependency determinism matters more than in a simple local script.

Unpinned Dependencies

Low
Category
Supply Chain
Content
redis>=4.5.0
jsonschema>=4.17.0
pydantic>=2.0.0
fastapi>=0.104.0
uvicorn>=0.24.0
python-dotenv>=1.0.0
pytest>=7.4.0
Confidence
98% confidence
Finding
FastAPI is an externally facing web framework, so leaving it unpinned can allow insecure or incompatible versions to be installed during deployment. For a Pub/Sub coordination service, framework-level issues can directly affect API exposure and request handling, increasing the practical security impact.

Unpinned Dependencies

Low
Category
Supply Chain
Content
jsonschema>=4.17.0
pydantic>=2.0.0
fastapi>=0.104.0
uvicorn>=0.24.0
python-dotenv>=1.0.0
pytest>=7.4.0
pytest-asyncio>=0.21.0
Confidence
98% confidence
Finding
Unpinned uvicorn versions can introduce server-side vulnerabilities, behavioral changes, or logging issues without notice. Because uvicorn is part of the HTTP serving stack, drift here affects the attack surface of any exposed API endpoint in the skill.

Unpinned Dependencies

Low
Category
Supply Chain
Content
pydantic>=2.0.0
fastapi>=0.104.0
uvicorn>=0.24.0
python-dotenv>=1.0.0
pytest>=7.4.0
pytest-asyncio>=0.21.0
pytest-cov>=4.1.0
Confidence
95% confidence
Finding
Leaving python-dotenv unpinned weakens supply-chain integrity and can allow unreviewed changes into the environment setup path. The direct impact is lower than for network-facing libraries, but environment-loading code can still influence secrets handling and local file operations.

Unpinned Dependencies

Low
Category
Supply Chain
Content
fastapi>=0.104.0
uvicorn>=0.24.0
python-dotenv>=1.0.0
pytest>=7.4.0
pytest-asyncio>=0.21.0
pytest-cov>=4.1.0
Confidence
90% confidence
Finding
Pytest is a development dependency, and unpinned versions mainly threaten reproducibility and CI integrity rather than production runtime directly. It is still a supply-chain hygiene issue because compromised or breaking versions could affect testing reliability and release assurance.

Unpinned Dependencies

Low
Category
Supply Chain
Content
uvicorn>=0.24.0
python-dotenv>=1.0.0
pytest>=7.4.0
pytest-asyncio>=0.21.0
pytest-cov>=4.1.0
Confidence
90% confidence
Finding
An unpinned pytest-asyncio version can cause inconsistent test behavior and reduce confidence in async code validation across environments. This is primarily a build and assurance issue, not a direct production exploit path.

Unpinned Dependencies

Low
Category
Supply Chain
Content
python-dotenv>=1.0.0
pytest>=7.4.0
pytest-asyncio>=0.21.0
pytest-cov>=4.1.0
Confidence
90% confidence
Finding
Unpinned pytest-cov can change coverage tooling behavior unexpectedly, weakening reproducibility and potentially masking test gaps. The security impact is indirect but relevant because unstable tooling can reduce assurance that vulnerable changes are caught.

Known Vulnerable Dependency: redis — 4 advisory(ies): CVE-2023-28858 (redis-py Race Condition vulnerability); CVE-2023-28859 (redis-py Race Condition due to incomplete fix); CVE-2023-28858 (redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connectio) +1 more

High
Category
Supply Chain
Confidence
99% confidence
Finding
The requirement allows redis versions from 4.5.0 upward, which includes known vulnerable releases such as those affected by the redis-py connection race-condition issues. In a swarm coordinator that likely uses Redis-backed Pub/Sub and shared state, a vulnerable client library is more dangerous because concurrency and connection reuse are core to the skill's operation.

Known Vulnerable Dependency: pydantic — 3 advisory(ies): CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.)

High
Category
Supply Chain
Confidence
97% confidence
Finding
The dependency spec permits pydantic versions with known issues, including denial-of-service risk from regular expression processing and older infinite-loop behavior. Since this skill appears to validate structured agent messages and schemas, untrusted input flowing through pydantic increases the chance that these weaknesses are reachable in practice.

Known Vulnerable Dependency: fastapi — 3 advisory(ies): CVE-2021-32677 (Cross-Site Request Forgery (CSRF) in FastAPI); CVE-2021-32677 (FastAPI is a web framework for building APIs with Python 3.6+ based on standard ); CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )

High
Category
Supply Chain
Confidence
96% confidence
Finding
FastAPI versions matching this loose constraint may include known security issues, and as a web framework any such issue can be exposed remotely through API endpoints. In a multi-agent coordination service, externally reachable control or status endpoints make framework vulnerabilities especially consequential.

Known Vulnerable Dependency: uvicorn — 4 advisory(ies): CVE-2020-7694 (Log injection in uvicorn); CVE-2020-7695 (HTTP response splitting in uvicorn); CVE-2020-7694 (This affects all versions of package uvicorn. The request logger provided by the) +1 more

High
Category
Supply Chain
Confidence
97% confidence
Finding
The uvicorn requirement allows vulnerable server versions associated with log injection and HTTP response-splitting style issues. Because uvicorn is the front-line ASGI server for any exposed API in this skill, these flaws could be directly exercised by remote clients depending on deployment and logging configuration.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low
Category
Supply Chain
Confidence
72% confidence
Finding
The requirement permits versions of python-dotenv associated with a reported file-overwrite issue in set_key, though exploitability depends on whether that helper is actually used on attacker-controlled paths. In this requirements file alone there is no evidence of active exploitation, but the loose version range does not exclude affected releases.

Static analysis

No suspicious patterns detected.