team-adversarial-swarm
Warn
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The ScriptScorer class in scripts/scoring.py uses importlib.util to dynamically load and execute Python code from a file path specified in the skill's configuration. This allows the skill to execute arbitrary Python logic at runtime based on the contents of the swarm-config.json file.
- [COMMAND_EXECUTION]: The skill's main coordination logic in SKILL.md and its test suite in scripts/test_aco.py perform shell command execution via the Bash tool and Python's subprocess module to manage the Ant Colony Optimization lifecycle.
- [PROMPT_INJECTION]: The wf-swarm-explore.js workflow script enables agents to read and analyze files within the workspace using the Read tool. This presents an indirect prompt injection surface, as content within these files could contain instructions that attempt to hijack the agent's behavior.
- Ingestion points: File reading logic in workflows/wf-swarm-explore.js.
- Boundary markers: The agent prompts do not utilize clear delimiters or instructions to treat file content as passive data.
- Capability inventory: The skill possesses broad file system access (Write, Edit, Glob) and command execution capabilities (Bash).
- Sanitization: No validation or filtering is applied to the content of the files read during exploration.
Audit Metadata