Swarm Orchestration
Fail
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the package 'agentic-flow' via npx. This name is a typosquat of the vendor's name 'aegntic'. By swapping the 'e' and 'g' characters, the author attempts to mislead users into executing code from an external package that does not belong to the official vendor infrastructure.\n- [REMOTE_CODE_EXECUTION]: By using npx to run a typosquatted package, the skill effectively facilitates the download and execution of untrusted remote code on the user's system.\n- [COMMAND_EXECUTION]: Multiple sensitive operations, such as swarm initialization and agent spawning, are performed using the potentially malicious 'agentic-flow' package.\n- [PROMPT_INJECTION]: The task orchestration features present a surface for indirect prompt injection because the skill ingests and processes untrusted natural language goals.\n
- Ingestion points: The '--task' CLI argument and the 'goal' field in the autoOrchestrate API call.\n
- Boundary markers: No delimiters or protective instructions are provided to isolate task data from the agent's core instructions.\n
- Capability inventory: The system coordinates specialized agents (e.g., 'coder', 'tester') that possess the capability to perform complex actions based on these goals.\n
- Sanitization: There is no evidence of validation or filtering for the input task content.
Recommendations
- AI detected serious security threats
Audit Metadata