swarm-executor

• Risk level: Low
• Analyzed: Apr 25, 2026, 5:34 AM
• Findings: 0
• Version: 1.1.0

Overview

The package implements a coherent multi-agent coordination library (protocol, pub/sub, negotiation, token budget) that matches its description; nothing in the files demands unrelated credentials or hidden endpoints, but review runtime dependency & Redis usage before deploying to production.

This skill appears to do what it claims: a library for coordinating multi-agent workflows with in-memory or Redis Pub/Sub, token budgeting, negotiation, and agent tracking. Before installing or running it: - If you plan to use Redis, provide a trusted redis_url only (do not point to unknown/public Redis servers). Messages published to Redis can contain task payloads and could be read by whoever controls that Redis instance. - The registry package includes requirements.txt (fastapi, uvicorn, python-dotenv, etc.). Because there is no install spec, those dependencies won't be auto-installed — install only the packages you need. The full stack (FastAPI/uvicorn) may pull in a webserver surface you should review. - SKILL.md examples contain a minor API mismatch (use_redis=True vs the actual PubSubCoordinator signature). Double-check examples against the code before copying. - The code sets up default agent IDs and includes logic where agent "001" (CEO) can cancel negotiations; if you map external agents to those IDs, ensure authentication/authorization is enforced by your deployment to prevent unauthorized cancellations. - Review docker-compose.yml and any omitted files before running to ensure they don't start unexpected network services. If you need a second opinion, provide the docker-compose.yml and any omitted runtime files and I can check them for external endpoints or secret handling.