Security audit

Colony

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for multi-agent orchestration, but it includes unsafe shell and path handling that could let crafted configuration or workflow metadata run commands or write files outside its intended area.

Review this before installing in any workspace that contains sensitive files or credentials. Only use trusted process definitions, agent configs, memory files, and notification settings; avoid shared or untrusted repositories until the shell command construction and path containment issues are fixed.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/colony.mjs:115
Finding: OS Command Injection Through the Telegram Notification Target
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/colony-worker.mjs:49
Finding: OS Command Injection Through Detached Worker Metadata
Content: View full analysis
'); process.exit(1); } const meta = JSON.parse(readFileSync(metaFile, 'utf-8')); const { taskId, agentName, agentRole, sessionId, promptFile, tasksFile, contextDir, startTime, outputs, runId, stageId, taskDescription, createdAt } = meta; ``` ```js // Read prompt and execute agent const promptContent = readFileSync(promptFile, 'utf-8'); const promptB64 = Buffer.from(promptContent).toString('base64'); // Use base64 + subshell to avoid escaping issues const cmd = `echo "${promptB64}" | base64 -d | openclaw agent --session-id "${sessionId}" --message "$(cat)" --json --timeout 1800`; const result = execSync(cmd, { encoding: 'utf-8', timeout: 1800000, // 30 minutes maxBuffer: 10 * 1024 * 1024, shell: '/bin/bash' }); ``` ### Technical Analysis The worker accepts a metadata file path from the command line, parses the file without schema validation, and interpolates `sessionId` directly into a Bash command enclosed in double quotes. Double quotes do not prevent all shell interpretation, and a crafted value can terminate the argument or introduce command substitution and additional syntax. The Base64 transformation protects only the prompt body. It does not protect `sessionId`, and the use of `$(cat)`, a pipeline, and an explicit Bash shell unnecessarily enlarges the command-injection surface. The normal producer creates `sessionId` from an agent name and a generated task ID. However, the worker is directly executable, trusts any supplied metadata file, and agent names originate in editable YAML configuration. Therefore, this boundary cannot safely assume that metadata fields a ...[truncated 892 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/learning.mjs:34
Finding: Path Traversal in Persistent Agent Memory File Handling
Content: View full analysis
[add "lesson"]'); process.exit(1); } const subCmd = args[2]; if (subCmd === 'add') { const lesson = args[3]; if (addToAgentMemory(agentName, lesson, section)) { console.log(`✓ Added to ${agentName}'s "${section}"`); } } else { showAgentMemory(agentName); } break; } ``` ### Technical Analysis `path.join()` normalizes traversal components but does not guarantee that the resulting path remains inside `MEMORY_DIR`. An `agentName` containing `../` segments can therefore resolve outside the intended memory directory. The `.md` suffix limits the target filename type but does not enforce directory confinement. No allowlist check against `colony/agents.yaml` is performed before reading or modifying the derived path. ### Attack Path 1. An attacker supplies a traversal-bearing agent name to the `memory` command. 2. `getMemoryPath()` appends `.md` and normalizes the path. 3. The resulting path escapes `colony ...[truncated 667 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/colony-worker.mjs:79
Finding: Workflow Output Path Traversal Allows Writes Outside the Run Context
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: scripts/learning.mjs:91
Finding: Persistent Agent Memory Accepts Untrusted Instructions Without a Trust Boundary
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (91)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.
md
node scripts/colony.mjs dispatch "find top 5 time-series databases"

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/agent-wrapper.mjs:54

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/colony-worker.mjs:56

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/colony.mjs:104