Swarm Orchestrator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:53 PM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate local agent orchestrator, but its install instructions pull and run unpinned external code with broad local privileges, so users should review it before installing.

Install only after reviewing the referenced repository and package contents. Prefer an isolated environment, avoid running as root, avoid global npm installation if possible, pin to a full verified commit or signed release, keep ports bound to localhost, and provide OpenAI or Anthropic API keys only when you intentionally enable LLM agents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: skill.md:630

Finding

Execution of Unpinned Code and Dependencies from External Sources

Content

View full analysis

Remediation

View remediation

" git clone https://github.com/ZhenRobotics/openclaw-swarm-orchestrator.git cd openclaw-swarm-orchestrator git checkout --detach "$EXPECTED_COMMIT" test "$(git rev-parse HEAD)" = "$EXPECTED_COMMIT" || exit 1 ``` 2. Publish signed releases and verify the release signature against a documented, trusted maintainer key. Do not accept a mutable “latest release tag” as equivalent to a pinned commit. 3. Include the actual implementation, manifests, container definitions, and lockfiles in the auditable Skill artifact, or clearly identify them as external unaudited components. 4. Pin all direct and transitive Python and npm dependencies: - Use a Python lockfile or requirements file containing exact versions and cryptographic hashes. - Use `package-lock.json` or another supported lockfile and install with `npm ci`. - Prevent silent dependency updates during installation. 5. Pin every container image by immutable digest rather than a mutable tag: ```yaml image: repository/image@sha256: ``` 6. Avoid global npm installation. Install into an isolated project directory or disposable container without elevated privileges. 7. Disable or strictly review npm lifecycle scripts where feasible. Review Python build backends and source distributions before permitting build-time execution. 8. Run the service with least privilege: - Do not install or launch it as root. - Do not expose the Docker socket to the application. - Restrict filesystem mounts, Linux capabilities, environment variables, and network access. - Provide API keys only when an explicitly enabled LLM agent requires them. 9. Add automated integrity checks that fail closed before Docker, npm, pip, or application execution. Merely displa ...[truncated 105 chars]

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (25)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · skill.md (reported line 555)May include surrounding context.

md

- **Open source** - all code is auditable

### What This Skill Does NOT Do
- ❌ Does not send data to external servers (except optional LLM APIs)
- ❌ Does not collect analytics or telemetry
- ❌ Does not require account registration
- ❌ Does not access your files without permission

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · readme.md (reported line 133)May include surrounding context.

md

}
}

response = requests.post(
    "http://localhost:8000/api/agents",
    json=agent
)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · readme.md (reported line 149)May include surrounding context.

md

}
}

response = requests.post(
    "http://localhost:8000/api/agents",
    json=agent
)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · readme.md (reported line 484)May include surrounding context.

md

}
}

response = requests.post(
    "http://localhost:8000/api/agents",
    json=agent
)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · readme.md (reported line 500)May include surrounding context.

md

}
}

response = requests.post(
    "http://localhost:8000/api/agents",
    json=agent
)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · readme.md (reported line 133)May include surrounding context.

md

}
}

response = requests.post(
    "http://localhost:8000/api/agents",
    json=agent
)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · readme.md (reported line 484)May include surrounding context.

md

}
}

response = requests.post(
    "http://localhost:8000/api/agents",
    json=agent
)

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · readme.md (reported line 133)May include surrounding context.

md

}
}

response = requests.post(
    "http://localhost:8000/api/agents",
    json=agent
)

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · readme.md (reported line 149)May include surrounding context.

md

}
}

response = requests.post(
    "http://localhost:8000/api/agents",
    json=agent
)

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · readme.md (reported line 484)May include surrounding context.

md

}
}

response = requests.post(
    "http://localhost:8000/api/agents",
    json=agent
)

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · readme.md (reported line 500)May include surrounding context.

md

}
}

response = requests.post(
    "http://localhost:8000/api/agents",
    json=agent
)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · readme.md (reported line 149)May include surrounding context.

md

"priority": "high"
}

response = requests.post(
    "http://localhost:8000/api/tasks",
    json=task
)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · readme.md (reported line 500)May include surrounding context.

md

"priority": "high"
}

response = requests.post(
    "http://localhost:8000/api/tasks",
    json=task
)

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · readme.md (reported line 159)May include surrounding context.

python

# 获取系统状态
status = requests.get("http://localhost:8000/api/orchestrator/status")
print(status.json())

# 列出所有智能体

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · readme.md (reported line 163)May include surrounding context.

python

# 获取系统状态
status = requests.get("http://localhost:8000/api/orchestrator/status")
print(status.json())

# 列出所有智能体

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · readme.md (reported line 510)May include surrounding context.

python

# 获取系统状态
status = requests.get("http://localhost:8000/api/orchestrator/status")
print(status.json())

# 列出所有智能体

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · readme.md (reported line 514)May include surrounding context.

python

# 获取系统状态
status = requests.get("http://localhost:8000/api/orchestrator/status")
print(status.json())

# 列出所有智能体

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 76)May include surrounding context.

md

verification:
  check_commands:
    - "swarm-orchestrator --version"
    - "curl http://localhost:8000/health"
  expected_files:
    - "~/.swarm-orchestrator/config.yml"
    - "./data/swarm.db"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.md (reported line 442)May include surrounding context.

md

### 1. API 密钥
- ✅ 存储在 `.env` 文件中（不在代码中）
- ✅ 设置文件权限：`chmod 600 .env`
- ✅ 将 `.env` 添加到 `.gitignore`
- ✅ 永远不要将 API 密钥提交到 git

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.md (reported line 453)May include surrounding context.

md

### 1. API 密钥
- ✅ 存储在 `.env` 文件中（不在代码中）
- ✅ 设置文件权限：`chmod 600 .env`
- ✅ 将 `.env` 添加到 `.gitignore`
- ✅ 永远不要将 API 密钥提交到 git

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.md (reported line 895)May include surrounding context.

md

### 1. API 密钥
- ✅ 存储在 `.env` 文件中（不在代码中）
- ✅ 设置文件权限：`chmod 600 .env`
- ✅ 将 `.env` 添加到 `.gitignore`
- ✅ 永远不要将 API 密钥提交到 git

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.md (reported line 906)May include surrounding context.

md

### 1. API 密钥
- ✅ 存储在 `.env` 文件中（不在代码中）
- ✅ 设置文件权限：`chmod 600 .env`
- ✅ 将 `.env` 添加到 `.gitignore`
- ✅ 永远不要将 API 密钥提交到 git

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 555)May include surrounding context.

md

- **Open source** - all code is auditable

### What This Skill Does NOT Do
- ❌ Does not send data to external servers (except optional LLM APIs)
- ❌ Does not collect analytics or telemetry
- ❌ Does not require account registration
- ❌ Does not access your files without permission

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The document is explicitly split into fixed Chinese and English versions, but it does not indicate that users may choose other languages or that the skill is intentionally limited to these locales. Under the language/locale policy, hard-coding supported languages without opt-in or justification can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The document is presented only in Chinese and English, and the manifest display name also hard-codes those two languages. There is no statement that the skill adapts to the user's preferred language or locale, which can conflict with an organizational policy requiring user opt-in for language choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.