Caveat verdict
agent-swarm
xmtp-agent-swarm
Decentralized agent coordination protocol over XMTP with USDC escrow payments on Base; all protocol message types are documented and the on-chain payment mechanism is transparent.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Permission integrity
package_install
Findings (7)
Pipe to python — executes piped content as Python code
skills/agent-swarm/scripts/demo-requestor.sh · prose · downgraded · | python3
Dynamic import() — loads module at runtime
skills/agent-swarm/cli.js · prose · downgraded · import('
References child_process — can spawn system processes
skills/agent-swarm/src/executor.js · prose · downgraded · child_process
Uses exec() — may execute shell commands
skills/agent-swarm/src/executor.js · prose · downgraded · exec(
Instructs covert action — may act without user awareness
skills/pi-optimize/SKILL.md · prose · downgraded · silently
Accesses sensitive environment variables
scripts/demo.js · prose · downgraded · process.env.WALLET_PRIVATE_KEY
Opens WebSocket connection
skills/pi-optimize/SKILL.md · prose · downgraded · WebSocket
Why the tier is capped
Execution sink present in raw bytes (Hard Floor: class B/D). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.
Permissions & capabilities
Requires 1 system binary.
package_install Is this flag fair?
Thanks — recorded.