Security audit

Colony Memory

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its memory backup purpose, but it exposes broader SDK authority than documented and has under-disclosed routing and dependency risks around sensitive agent memory and API keys.

Review before installing. Use this only with a tightly scoped Colony API key and a trusted runtime environment, avoid setting custom Colony API base URL variables unless you control the endpoint, and confirm snapshot labels and IDs before prune or delete operations. Prefer a version that pins the dependency, removes undeclared endpoint overrides, and uses an explicit action allowlist.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: main.py:75
Finding: Undocumented API endpoint override can redirect sensitive vault traffic
Content: View full analysis
ColonyMemory: api_key = os.environ.get("COLONY_MEMORY_API_KEY") or os.environ.get("COLONY_API_KEY") if not api_key: raise RuntimeError("COLONY_API_KEY (or COLONY_MEMORY_API_KEY) is not set") kwargs: dict[str, Any] = {"api_key": api_key} base = os.environ.get("COLONY_MEMORY_API_BASE") or os.environ.get("COLONY_API_BASE") if base: kwargs["base_url"] = base ``` ### Technical Analysis The code allows `COLONY_MEMORY_API_BASE` or `COLONY_API_BASE` to replace the expected Colony service endpoint without validating the URL scheme or destination hostname. These variables are not declared in the skill manifest's environment-variable permissions, which only list the API keys and signing seed. The same `ColonyMemory` client configuration contains both the caller's API key and the supplied base URL. Depending on the SDK's HTTP authentication behavior, requests directed to an attacker-controlled endpoint may disclose authorization credentials. Backup requests can also expose sensitive memory documents directly in their request bodies. An attacker-controlled service could return fabricated snapshot data during restore operations. Exploitation requires the attacker to influence the process or deployment environment. This is particularly relevant where environment variables can be configured by an orchestrator, wrapper, shared runtime, or untrusted deployment template. ### Attack Path 1. The attacker obtains the ability to influence environment variables used to launch the skill. 2. The attacker sets `COLONY_MEMORY_API_BASE` or `COLONY_API_BASE` to an attacker-controlled URL. 3. A legitimate caller invokes `backup`, `restore`, or another network-backed operation. 4. `_build_memory()` constructs the SDK client with the legitim ...[truncated 791 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: main.py:31
Finding: Reflection exposes undocumented and potentially privileged SDK methods
Content: View full analysis
dict[str, Any]: action = request.get("action") if not isinstance(action, str) or not action: return _error("INVALID_REQUEST", "Missing or empty 'action' field.") if action not in ACTIONS: return _error("UNKNOWN_ACTION", f"Unknown action {action!r}. Valid: {sorted(ACTIONS)}") kwargs = {k: v for k, v in request.items() if k != "action"} try: mem = _build_memory() except RuntimeError as e: return _error("MISSING_API_KEY", str(e)) try: result = getattr(mem, action)(**kwargs) return {"status": "ok", "result": _serialisable(result)} ``` ### Technical Analysis The documented schema permits eight actions, but the executable allowlist is generated from every public callable present on `ColonyMemory`. Consequently, the actual interface is controlled by the installed dependency rather than by the reviewed skill definition. Any current or future public SDK method automatically becomes remotely invocable with the authority of the configured API key. The dispatcher also forwards every request property except `action` as a keyword argument. Because the input schema permits additional properties and the code performs no per-action validation, callers can provide arbitrary arguments accepted by an undocumented method. This violates least privilege and creates an interface-expansion vulnerability: upgrading the dependency can silently expose new administrative, destructive, diagnostic, or data-acces ...[truncated 1221 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unbounded third-party dependency creates non-reproducible and expanding trust
Content: View full analysis
=0.1.1 ``` ### Technical Analysis The requirement establishes only a minimum version and has no upper bound, exact pin, package hash, or lockfile. A fresh installation may therefore retrieve any future release satisfying the range. Third-party Python packages execute code during import and become part of the application's trusted computing base. This risk is amplified by the reflective dispatch in `main.py`: a future dependency version can change behavior and automatically expose newly introduced public methods as skill actions. Even absent a malicious release, incompatible or security-regressing updates can alter network behavior, credential handling, signature verification, or destructive operations without changes to this repository. This finding does not establish that the current `colony-memory` package is malicious. It identifies insufficient dependency integrity and version control. ### Attack Path 1. A future compromised, malicious, or security-regressing `colony-memory` release is published with a version greater than or equal to `0.1.1`. 2. A clean deployment resolves `colony-memory>=0.1.1` to that release. 3. Installation and application startup import and execute the dependency code. 4. The dependency receives access to API credentials, signing configuration, network operations, and memory documents through normal skill execution. 5. Newly added public methods may also be exposed automatically by the reflective action discovery. 6. The compromised or unsafe dependency can misuse accessible data and privileges within the skill process. ### Impact Assessment A compromised dependency executes with the same process privileges as the skill. It may access the Colony API key, signing seed, stdin memory content, network connectivity, and any resources ava ...[truncated 206 chars]
Remediation: View remediation
`. 2. Generate and enforce cryptographic hashes using a lockfile or hash-checked requirements file. 3. Install with `pip --require-hashes` in reproducible deployments. 4. Review release notes and source changes before upgrading the pinned version. 5. Run dependency vulnerability and provenance checks in CI. 6. Use a trusted package index and prevent fallback to unapproved indexes to reduce dependency-confusion risk. 7. Combine dependency pinning with an explicit action mapping so dependency upgrades cannot silently expand the skill interface. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file documents a delete_snapshot action and retention-pruning behavior, both of which can remove stored memory snapshots, but it does not warn that these operations may be destructive or irreversible. Under the markdown-file criteria for missing user warnings, actions affecting user data should include an explicit caution about deletion risk.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The module documentation presents this as a narrowly scoped backup/restore/status entrypoint, but the implementation exposes every public ColonyMemory method as remotely invokable actions. That mismatch can cause reviewers, operators, and integrating agents to grant trust or permissions based on a false understanding of the skill’s capabilities, enabling unintended sensitive operations if ColonyMemory contains additional networked, destructive, or administrative methods.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This code exposes all non-underscore callable methods on ColonyMemory as externally callable actions, with no per-method authorization, argument policy, or least-privilege boundary. If the underlying SDK adds methods for deletion, raw vault access, reconfiguration, signing-related operations, or future privileged features, they become instantly reachable through stdin-driven RPC without any intentional review, creating a broad attack surface and a dangerous supply-chain style expansion of capabilities over time.
Content: No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Confidence: 50% confidence
Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
Content: Scanner excerpt · main.py (reported line 100)May include surrounding context.
python
return _error("MISSING_API_KEY", str(e)) try: result = getattr(mem, action)(**kwargs) return {"status": "ok", "result": _serialisable(result)} except TypeError as e: return _error("INVALID_ARGS", str(e))

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: The dependency is specified with a lower-bound range (>=0.1.1) rather than an exact version, so future installs may resolve to different releases over time. This weakens build reproducibility and creates supply-chain risk because a later compromised, vulnerable, or breaking version of colony-memory could be pulled in without review.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
colony-memory>=0.1.1

Static analysis

No suspicious patterns detected.