Security audit

Colony Memory

Security checks for vulnerabilities and agentic risk

Overview

The skill's memory backup purpose is coherent, but its code exposes more runtime actions than the published action list for a sensitive agent-memory tool.

Install only if you are comfortable giving this skill access to a Colony API key and agent memory snapshots. Review the dependency and prefer a version that uses an explicit allowlist for actions, pins or constrains the SDK behavior, and adds confirmation or clear warnings for restore, prune, and delete_snapshot.

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill advertises a narrow action surface, but it exposes every public ColonyMemory method as remotely invokable. That creates an unexpected capability expansion: any newly added or less-reviewed public SDK method becomes callable through stdin JSON, potentially enabling destructive, privileged, or privacy-impacting operations beyond backup/restore/status.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The module documentation states that requests are dispatched according to a described action catalogue, but the implementation actually dispatches to any public ColonyMemory method. This documentation/implementation mismatch is dangerous because users and reviewers may grant the skill more trust than warranted, while hidden capabilities remain accessible at runtime.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill exposes a `restore` action that can replace an agent's current memory state, but the description does not clearly warn users that invoking restore may overwrite or roll back existing state. In an agent context, this can lead to integrity loss, unexpected behavior, or operational disruption if a user or upstream planner triggers restore without understanding its destructive effect.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documented `prune` and `delete_snapshot` actions are destructive, but the skill text does not prominently warn that they permanently remove snapshot history. This increases the chance of accidental data loss, especially because the tool is explicitly designed for durable agent memory and users may assume recovery is always possible.

Static analysis

No suspicious patterns detected.