Versioned security assessment

Report ID: SA-45260285

6/29/2026, 7:51:06 PM

swarm-advanced security assessment v7

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
swarm-advanced
Version
v7
Maintainer
Claude Flow Team
Source
github.com/DNYoussef/ai-chrome-extension/tree/main/.claude/skills/swarm-advanced
Coverage
1 Files scanned · 974 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

3 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis flagged many command and blocker patterns, but review shows most are Markdown examples for Claude Flow MCP and CLI usage. The real concern is that the skill instructs users to install and run external packages, execute project scripts, configure automation, and write backups, so it should publish with a clear execution warning rather than be blocked.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 974 Lines analyzed

3 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 1 evidence location

Filesystem access

May read or write local files.

Observed in 1 evidence location

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 6 evidence locations

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (3)

RISK-001 Medium
SKILL.md:17-22SKILL.md:241-248SKILL.md:385-390SKILL.md:585-590
External Package Installation and CLI Execution Guidance
The skill tells users to install claude-flow globally and configure an MCP server through npx, then provides npx-based swarm commands. This is legitimate for the stated purpose, but it executes third-party tooling from the package ecosystem and should be treated as elevated risk.
The command examples are directly present and would run external package code if followed. Confidence is below very high because the behavior is disclosed and aligned with the skill purpose, with no evidence of malicious intent.
RISK-002 Medium
SKILL.md:496-520SKILL.md:650-655SKILL.md:781-799
Orchestrated Project Command and Automation Execution
The skill demonstrates swarm tasks that run project test scripts, security scans, analysis tasks, and event-driven automation. These examples can be useful, but they may execute repository-defined scripts or automated actions with side effects in a user workspace.
The documented commands and automation triggers are clear, but they are examples rather than hidden executable code. Risk depends on the user workspace and Claude Flow runtime configuration.
RISK-003 Medium
SKILL.md:732-735
Filesystem Backup Example Uses Absolute Workspace Path
The memory backup example writes to an absolute workspace path. This is not malicious by itself, but it indicates filesystem write behavior that users should review before enabling backups.
The backup path is explicitly shown and suggests filesystem writes. The risk is moderate because it is a documented example and does not target sensitive paths.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (3)
Low
SKILL.md:963-966
Hardcoded Documentation URLs
The hardcoded URLs point to Claude Flow documentation and wiki pages. They create normal outbound browsing risk but do not show data exfiltration or hidden network behavior.
The URLs are visible reference links at the end of the documentation. No evidence found that the skill sends user data to these URLs.
Low
SKILL.md:3SKILL.md:273SKILL.md:872SKILL.md:919
Static Weak-Crypto and Reconnaissance Matches Are Descriptive Text
The high blocker matches occur in ordinary prose or example labels such as description, design, architecture, analysis, and responsibilities. No evidence found of cryptographic API use, weak hashing, credential handling, or system reconnaissance code.
Reviewed cited lines show documentation words and workflow descriptions, not crypto or reconnaissance primitives. This is a strong false positive from keyword matching.
Low
SKILL.md:17SKILL.md:74SKILL.md:907-912
Markdown Code Fence Backticks Misclassified as Ruby Execution
Most external-command detections correspond to Markdown code fence delimiters around JavaScript examples. The backticks are formatting markers, not Ruby shell backtick execution.
The cited syntax is Markdown fencing around examples. Some fenced examples include real commands, but the Ruby backtick execution label itself is inaccurate.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable