Skills/Glama/swarm-engine

swarm-engine@1.0.0

CAUTION· startup only

Publisher claims: "Enables AI coding agents to spawn, parallelize, and synchronize multi-agent programming swarms through a stdio MCP interface. Provides tools for DAG-scheduled task dispatch, isolated Git worktree execution, atomic file locking, shared blackboard memory, and clean merging of completed agent work back to the main repository." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher priyagdev · publishing for 3 daysInstalls 0Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
no credential variables read in the code
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it under the guard. Startup only; authenticated tool behavior not tested. The code names no credential variable; the guard pins the network to what the honeypot saw and logs every call.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-11 and scored it 75/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Collapsed <details> block carrying instructions; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 23 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
2.9sprocessdependency install exit 0
23sclaimedstartup only: exited (0) before answering · --keep-blackboard Preserve blackboard memory keys during reset GLOBAL OPTIONS: --help, -h Show this help message --version, -v Show version
23sprocessscript backend runs setup only
23sprocessno install scripts to re-run

Static findings

HIGH
Collapsed <details> block carrying instructionsREADME.md:110 · Collapsed <details> block carrying instructions<summary><b>🤖 Using with Kilo Code / Kilo CLI</b></summary> 1. **Auto Model Detection**: Swarm Engine reads your `~/.config/kilo/kilo.jsonc` file automaticallyFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsskills/swarm-engine/SKILL.md:77 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files… models from your environment (`.config/kilo/kilo.jsonc`, Claude Code, Cursor, `.env`, Ollama) with zero hardcoded model names. ### 1. Initialize Swarm (`init`) Cr…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/tier6_fable_workers.test.mjs:184 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filespath.join(ws.dir, ".env"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/harness.mjs:50 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv: { ...process.env, ...env },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/tier6_fable_workers.test.mjs:181 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesawait t.test("T6-ACT-05: detectActiveModels discovers models automatically from workspace .env", async () => {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/tier6_fable_workers.test.mjs:213 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesawait fs.rm(path.join(ws.dir, ".env"), { force: true });Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandtest/test_lifecycle.mjs:795 · Process kill command — agent can terminate processesawait t.test('F7-T2-03: swarm kill on non-existent agent handled gracefully with error', async (ct) => {Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandtest/test_lifecycle.mjs:821 · Process kill command — agent can terminate processes// Repeated kill must be idempotent or return clean errorFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/detector.js:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* 3. Local workspace .env and .env.local filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Collapsed <details> block carrying instructionsREADME.md:119 · Collapsed <details> block carrying instructions<summary><b>🟣 Using with Claude Code</b></summary> 1. The skill is installed at `~/.claude/skills/swarm-engine`. 2. Claude Code will automatically invoke `swarFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsdist/detector.d.ts:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* 3. Local workspace .env and .env.local filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandtest/test_lifecycle.mjs:389 · Process kill command — agent can terminate processes// Minion attempts to kill bossFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandtest/test_recovery.mjs:45 · Process kill command — agent can terminate processesreturn err.code === 'EPERM'; // EPERM means process exists but we lack kill permissionFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandtest/test_lifecycle.mjs:225 · Process kill command — agent can terminate processesawait t.test('F7-T1-03: swarm kill marks agent killed and releases all associated resources', async (ct) => {Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/detector.ts:209 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* Searches .env and .env.local in the target workspace directory.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/detector.js:178 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst envFiles = [".env", ".env.local", ".env.development"];Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/detector.d.ts:52 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* editor settings, and workspace .env files.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/detector.ts:212 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst envFiles = [".env", ".env.local", ".env.development"];Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Collapsed <details> block carrying instructionsREADME.md:217 · Collapsed <details> block carrying instructions<summary><b>Q: How does it know which model to use?</b></summary> Swarm Engine contains an intelligent model detector ([`src/detector.ts`](src/detector.ts)): - Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Collapsed <details> block carrying instructionsREADME.md:200 · Collapsed <details> block carrying instructions<summary><b>Q: Will Swarm Engine mess up my Git branches or commit history?</b></summary> **No.** Swarm Engine was specifically engineered to protect your Git rFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Access to sensitive file pathstest/tier6_fable_workers.test.mjs:212 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Remove .env so local kilo is chosenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Collapsed <details> block carrying instructionsREADME.md:127 · Collapsed <details> block carrying instructions<summary><b>💻 Using with Cursor</b></summary> 1. Open your integrated terminal in Cursor (`Ctrl + ~`). 2. Run `swarm-engine run "your task"` in the terminal. 3Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathssrc/detector.ts:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* 3. Local workspace .env and .env.local filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandtest/test_lifecycle.mjs:810 · Process kill command — agent can terminate processesawait t.test('F7-T2-04: swarm kill on already killed agent is idempotent or returns error', async (ct) => {Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/detector.js:175 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* Searches .env and .env.local in the target workspace directory.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiontest/empirical_stress_m1.mjs:137 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(' [CLI status output snippet]:');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Collapsed <details> block carrying instructionsREADME.md:226 · Collapsed <details> block carrying instructions<summary><b>Q: Do I need to configure MCP (Model Context Protocol)?</b></summary> **No!** While Swarm Engine includes a full MCP server (`swarm-engine mcp`), weFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01

Cost to the agent

Instructions loaded
≈3,779 tok
1 file · 58 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

5 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim priyagdev: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim priyagdevPropose a patch to the maintainer