Zhonghao1995/agentic-swmm-workflow
Agentic SWMM is an automated, auditable, and memory-informed framework for reproducible stormwater modelling, integrating QGIS and EPA SWMM through the aiswmm runtime, reusable Skills, and MCP interfaces, with QA verification, provenance tracking, calibration support, and Codex, Hermes, Claude code as well as OpenClaw compatibility
risk
- capability exposure inferred + 35
- tool safety inferred + 5
- trust mitigators mixed − 3
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
risk trajectory
- D · 64 → C · 37
- C · 56 → D · 64
- A · 0 → C · 56
capability exposure
vulnerabilities
No known CVEs for this server.
tool safety
- medium dangerous code
dynamic exec: __import__(), eval()/exec(), __import__ sink
skills & danger signals
analyzed commit a64d950 · analyzer v33 · 2w ago
skills & prompt files 17
- skill skills/skill-author/SKILL.md
- skill skills/swmm-anywhere/SKILL.md
- skill skills/swmm-builder/SKILL.md
- skill skills/swmm-calibration/SKILL.md
- skill skills/swmm-canada/SKILL.md
- skill skills/swmm-climate/SKILL.md
- skill skills/swmm-design-review/SKILL.md
- skill skills/swmm-end-to-end/SKILL.md
- skill skills/swmm-experiment-audit/SKILL.md
- skill skills/swmm-gis/SKILL.md
- skill skills/swmm-network/SKILL.md
- skill skills/swmm-params/SKILL.md
- skill skills/swmm-plot/SKILL.md
- skill skills/swmm-report/SKILL.md
- skill skills/swmm-runner/SKILL.md
- skill skills/swmm-uncertainty/SKILL.md
- skill skills/swmm-water-quality/SKILL.md
danger signals4
- dynamic code execution __import__() tests/test_doctor_cli_extension.py :86
wraps=__import__( - dynamic code execution eval()/exec() tests/test_resources_resolve_on_a_pip_install.py :126
exec(compile(source.split("setup(data_files=")[0], str(REPO / "setup.py"), "exec"), ns) - dynamic code execution __import__ sink tests/test_welcome_disabled_env.py :68
for k, v in __import__("os").environ.items() - suspicious endpoint 169.254.169.254 (cloud metadata) tests/test_web_fetch_ssrf.py :23
"http://169.254.169.254/latest/meta-data/",
embed badge
[](https://mcpobservatory.com/servers/github:Zhonghao1995/agentic-swmm-workflow/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of Zhonghao1995.