swarm

Pass

Audited by Gen Agent Trust Hub on Sep 7, 2026

Risk Level: SAFECREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The skill instructs the agent to read configuration from ~/.claude/pstack-models.md. Accessing files within hidden directories in the user's home folder is a sensitive file access pattern that can lead to unintended data exposure if the file contains sensitive information or if the path is manipulated.
  • [INDIRECT_PROMPT_INJECTION]: The skill's aggregation phase (Phase C) involves reading terminal results from N parallel workers to create a consolidated report. This creates an attack surface where malicious content processed by a worker could be designed to influence the parent agent's summary or subsequent operations.
  • Ingestion points: Phase C and Phase D involve reading and consolidating output from multiple subagent_type: "general-purpose" workers.
  • Boundary markers: The skill does not define explicit delimiters or instructions for the agent to ignore potential instructions embedded in worker reports.
  • Capability inventory: The skill has the ability to spawn background subagents, access the file system (via worktrees, branches, and /tmp/), and perform git operations.
  • Sanitization: There are no instructions for sanitizing or escaping the content gathered from workers before it is aggregated into the final report.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 7, 2026, 11:13 PM
Security Audit — agent-trust-hub — swarm