← Back to Skills Marketplace
Hackathon Swarm Coding
by
Arun Nadarasa
· GitHub ↗
· v0.1.2
766
Downloads
3
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install swarm-coding-skill
Description
Autonomously plans, develops, tests, and delivers full software projects from plain-English prompts using coordinated multi-agent roles and automated quality...
Usage Guidance
Before installing or running this skill:
- Treat it as requiring an OpenRouter API key (OPENROUTER_API_KEY). The registry listing omitted this — verify the key and its model access.
- Run the skill only inside a clean, isolated workspace directory (no other .env or secret files there). The orchestrator reads .env from the workspace root and will throw if missing; if your workspace .env contains other secrets, they could be read by the skill.
- Use MOCK=1 for a dry run to see behavior without API calls.
- Expect generated code and logs (swarm-projects/, DECISIONS.md, .learnings/) to contain your prompts and agent reasoning; review and remove sensitive content before sharing or committing to VCS.
- Pay special attention to any blockchain/Privy integration the skill auto-includes — review auth-related code and never paste real private keys or secrets into prompts.
- If you want to reduce risk, run the skill inside a disposable container/VM or dedicated OS user directory, and ensure .env contains only the OpenRouter key you intend to share. Remove or rotate the key after testing if appropriate.
- Ask the publisher to fix the metadata inconsistency (declare required env vars in the registry) and to document exactly what the orchestrator reads from .env.
Capability Analysis
Type: OpenClaw Skill
Name: swarm-coding-skill
Version: 0.1.2
The skill is highly suspicious due to a critical arbitrary file write vulnerability in `orchestrator.js`. The `parseWorkerOutput` function uses `path.join` with LLM-generated file paths, which can resolve `../` sequences. Combined with the skill's explicit operation on the parent workspace (`WORKSPACE_ROOT = path.resolve(__dirname, '..');`), a malicious prompt could instruct the LLM to write files outside the intended project directory (e.g., `../../../.ssh/authorized_keys`), leading to potential Remote Code Execution (RCE). While the `SKILL.md` and `README.md` warn about writing to the parent workspace, this does not mitigate the underlying path traversal vulnerability.
Capability Assessment
Purpose & Capability
The skill's functionality (orchestrating an LLM to scaffold projects) legitimately requires an OpenRouter API key and filesystem access to write generated projects. However, the registry metadata provided to the platform lists no required env vars while SKILL.md and orchestrator.js both require OPENROUTER_API_KEY — an inconsistency that should be corrected/clarified.
Instruction Scope
SKILL.md and orchestrator.js instruct the agent to read a .env file from the workspace root (parent directory of the skill) and to write project files and persistent logs (swarm-projects/, DECISIONS.md, .learnings/). DECISIONS.md and .learnings/ capture prompts and agent reasoning. Reading the parent .env and persisting detailed logs increases the risk of accidental disclosure of unrelated secrets or sensitive prompt content.
Install Mechanism
There is no external install spec (instruction-only plus a single orchestrator.js). Nothing is downloaded from arbitrary URLs and no installer writes to unexpected system locations. This is the lower-risk install pattern.
Credentials
Requesting OPENROUTER_API_KEY is proportionate to the stated purpose. However, the orchestrator reads the entire .env at the workspace root (not just the declared variable), meaning any other credentials colocated in that .env are accessible by the skill. The registry metadata failing to declare the required env var is another proportionality/consistency issue. The automatic inclusion of Privy/web3 scaffolding when prompts mention blockchain is a functional choice but can lead to generation of auth-related code that requires review.
Persistence & Privilege
The skill persists project files and an ongoing learning log (.learnings/, DECISIONS.md) across runs and records prompts/agent reasoning. While 'always' is false, the retained logs create a persistent record on disk that may contain sensitive inputs. The skill does not modify other skills or system configs, but its local persistence and read access to workspace .env are notable privileges.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install swarm-coding-skill - After installation, invoke the skill by name or use
/swarm-coding-skill - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.2
- Introduced a structured YAML frontmatter specifying description, capabilities, required/optional environment variables, output paths, and external services.
- Added explicit warnings about workspace writes and handling of sensitive data in logs and decision files.
- Clarified environment variable requirements and improved documentation on configuration and outputs.
- Enhanced summary of capabilities, including clearer descriptions of knowledge grounding and continuous improvement features.
- Maintained all core functionality and agent workflow as previously described; no file or code changes detected.
v0.1.1
Swarm Coding Skill v0.1.1
- Added _meta.json file for metadata tracking.
- Removed legacy .clawhub/lock.json file.
- Updated documentation in SKILL.md:
- Clarified model usage (switched to `qwen/qwen3-coder` naming).
- Expanded requirements and environment variable details.
- Stressed user responsibility for security, compliance, and deployment.
- Added instructions for optional dry-run mode (`MOCK=1`).
- Improved explanations of where files/logs are written and workspace isolation.
v0.1.0
- Initial release of Swarm Coding Skill: fully autonomous, multi-agent app development from a plain-English prompt.
- Swarm orchestrator analyzes prompts, plans architecture, and manages agent roles for backend, frontend, QA, and DevOps.
- Automated task tracking, dependency management, and conflict avoidance via a generated `swarm.yaml`.
- Quality gates: no merging without passing tests and containerization if needed.
- Output includes a complete project directory, detailed readme, automated tests, container files, decision logs, and learning summaries.
- Continuous improvement support: errors, corrections, and feature requests are logged for smarter future runs.
Metadata
Frequently Asked Questions
What is Hackathon Swarm Coding?
Autonomously plans, develops, tests, and delivers full software projects from plain-English prompts using coordinated multi-agent roles and automated quality... It is an AI Agent Skill for Claude Code / OpenClaw, with 766 downloads so far.
How do I install Hackathon Swarm Coding?
Run "/install swarm-coding-skill" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Hackathon Swarm Coding free?
Yes, Hackathon Swarm Coding is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Hackathon Swarm Coding support?
Hackathon Swarm Coding is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Hackathon Swarm Coding?
It is built and maintained by Arun Nadarasa (@arunnadarasa); the current version is v0.1.2.
More Skills