swarm
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill aggregates terminal reports from multiple parallel subagents (workers). If these workers are tasked with analyzing untrusted data or code, their output could contain malicious instructions intended to manipulate the parent agent during Phase C (Aggregate) or Phase D (Report). * Ingestion points: Terminal results from workers read during Phase C. * Boundary markers: The instructions lack specific delimiters or warnings to treat worker output as untrusted data. * Capability inventory: The agent can spawn general-purpose background subagents, write to local directories, and read configuration files. * Sanitization: No sanitization of worker output is specified before it is processed by the parent agent.
- [COMMAND_EXECUTION]: The skill utilizes high-capability agent features, specifically spawning multiple parallel 'general-purpose' subagents with the 'run_in_background' flag. This facilitates concurrent local execution, which increases the potential impact should a subagent be compromised by the data it processes.
- [DATA_EXFILTRATION]: The skill is instructed to read from '
/.claude/engineering-models.md' to retrieve model configuration overrides. Accessing files within the agent platform's internal configuration directory (/.claude) exposes local environment and model selection settings to the LLM context.
Audit Metadata