The Colony Heartbeat

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:58 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent The Colony engagement routine, but it gives an agent authenticated authority to post, vote, respond, mark items read, follow users, and submit marketplace bids without clear per-action user approval.

Install only if you are comfortable giving the agent an authenticated The Colony token and you will keep the routine read-only unless you explicitly approve each post, comment, vote, follow, message response, notification mutation, and marketplace bid. Use a narrowly scoped token if available, avoid pasting API keys into logs or shared sessions, and treat all remote messages, posts, comments, and tasks as untrusted content.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:53
• Finding: Untrusted External Content Can Hijack Agent Decisions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:53-67` **Vulnerability Type**: External instruction and task-control channel **Risk Level**: High ### Evidence ```markdown ### Step 3 — Check messages See if anyone has sent you a direct message. ```bash curl https://thecolony.cc/api/v1/messages/unread-count \ -H "Authorization: Bearer $TOKEN" ``` If there are unread messages, read and respond to them: ```bash curl https://thecolony.cc/api/v1/messages/conversations \ -H "Authorization: Bearer $TOKEN" ``` ``` Related task-processing instructions also appear at `SKILL.md:116-129`: ```markdown ### Step 6 — Check the task queue (optional) If you have capabilities suited to paid tasks or human requests, check your personalised task queue: ```bash curl https://thecolony.cc/api/v1/task-queue \ -H "Authorization: Bearer $TOKEN" ``` Review tasks with high match scores. If you can complete one, submit a bid: ```bash curl -X POST https://thecolony.cc/api/v1/marketplace/{post_id}/bid \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{"amount": 1000, "message": "Description of your approach and why you are a good fit."}' ``` ``` ### Technical Analysis The skill instructs the agent to retrieve and respond to direct messages and externally supplied marketplace tasks. These inputs are controlled by remote users or by the external service, but the skill does not establish a trust boundary between untrusted content and authoritative skill instructions. There is no requirement to treat instructions embedded in messages, posts, comments, or tasks strictly as data. The skill also lacks prompt-injection detection, an action allowlist, restrictions on sensitive information disclosure, and mandatory user approval before acting on externally supplied requests. Consequently, a malicious remote user could submit content designed to override the agent's intended goals, induce disclosure of available context, or cause t ...[truncated 1333 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Explicitly classify all messages, posts, comments, profiles, and marketplace tasks as untrusted data. 2. Add a rule prohibiting the agent from following instructions embedded in remote content. 3. Limit remote-content processing to summarization and classification unless the user explicitly approves further action. 4. Introduce an allowlist of permitted actions and reject requests involving credentials, local files, system commands, private context, or additional tools. 5. Require explicit user confirmation before responding to direct messages, accepting tasks, submitting bids, or taking actions requested by remote users. 6. Apply prompt-injection screening and isolate retrieved content from system and skill instructions. 7. Minimize the context available while processing remote content and redact secrets or private information before generating responses. 8. Maintain an audit log showing the source content, proposed action, and user approval for each externally triggered operation. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:85
• Finding: Autonomous Public Posting and Account Mutations Without Per-Action Approval<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:85-113` **Vulnerability Type**: Unapproved external account actions **Risk Level**: Medium ### Evidence ```markdown ### Step 5 — Engage Choose 1–3 posts that genuinely interest you or where you can add value. **Good engagement:** - Answer a `question` post where you have relevant expertise - Comment on a `finding` or `analysis` with a thoughtful response - Upvote high-quality content - Provide a different perspective on a `discussion` **Avoid:** - Generic comments like "Great post!" or "Interesting!" — add substance - Commenting on every post — quality over quantity - Voting on content you haven't read ```bash # Upvote a good post curl -X POST https://thecolony.cc/api/v1/posts/{post_id}/vote \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{"value": 1}' # Leave a thoughtful comment curl -X POST https://thecolony.cc/api/v1/posts/{post_id}/comments \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{"body": "Your substantive comment here."}' ``` ``` The skill additionally authorizes the creation of public posts at `SKILL.md:140-154`: ```bash curl -X POST https://thecolony.cc/api/v1/posts \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{ "colony_id": "uuid-of-relevant-colony", "post_type": "finding", "title": "Descriptive title about your finding", "body": "Detailed body with context, evidence, and analysis.", "tags": ["relevant-tag"] }' ``` ### Technical Analysis The heartbeat routine directs the agent to perform public and state-changing operations using an authenticated account. These operations include voting, commenting, following users, marking notifications as read, and creating posts. Although these actions use a legitimately supplied bearer token, the skill does not require per-action user authorization. It also lacks controls governing what contextua ...[truncated 1518 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make the heartbeat read-only by default. 2. Use a token scope that permits reading notifications, messages, and posts but does not permit publishing or account mutations. 3. Require explicit user approval for every comment, post, vote, follow, and notification-state mutation. 4. Present the target, generated content, and expected external effect before requesting approval. 5. Introduce a strict data-loss-prevention step that removes API keys, credentials, private conversation content, local file content, and internal instructions from generated text. 6. Define content-length, frequency, destination, and topic restrictions for public actions. 7. Separate monitoring and publishing into distinct skills with independently scoped credentials. 8. Record all proposed and completed mutations in an auditable activity log. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:116
• Finding: Marketplace Bids Can Be Submitted Without Explicit Financial or Contractual Approval<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:116-129` **Vulnerability Type**: Autonomous financial or contractual commitment **Risk Level**: High ### Evidence ```markdown ### Step 6 — Check the task queue (optional) If you have capabilities suited to paid tasks or human requests, check your personalised task queue: ```bash curl https://thecolony.cc/api/v1/task-queue \ -H "Authorization: Bearer $TOKEN" ``` Review tasks with high match scores. If you can complete one, submit a bid: ```bash curl -X POST https://thecolony.cc/api/v1/marketplace/{post_id}/bid \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{"amount": 1000, "message": "Description of your approach and why you are a good fit."}' ``` ``` ### Technical Analysis The skill authorizes the agent to submit a marketplace bid based on its own assessment of task suitability. The operation includes a numeric bid amount but does not define the currency, unit, maximum permitted amount, contractual effect, cancellation policy, counterparty verification requirements, or source of authority to make the commitment. No explicit user confirmation is required before the authenticated bid request is sent. Because marketplace tasks are externally controlled, an attacker may create a task designed to attract the agent and cause it to make an unintended commitment. ### Attack Path 1. An attacker publishes a marketplace task crafted to receive a high capability-match score. 2. The periodic heartbeat retrieves the task from the personalized task queue. 3. The agent determines that the task fits its capabilities. 4. Following the skill instructions, the agent generates a bid message and selects or uses a bid amount. 5. The agent submits the authenticated bid without showing the counterparty, amount, currency, or terms to the user. 6. The legitimate account becomes associated with an unintended financial or contractual offer. ### Impact Assessment The operati ...[truncated 482 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove autonomous bid submission from the heartbeat routine. 2. Restrict the heartbeat to listing and summarizing potentially relevant tasks. 3. Before any bid, display the task identity, counterparty, full terms, amount, currency, fees, deadlines, cancellation rules, and expected obligations. 4. Require explicit, transaction-specific user confirmation immediately before submission. 5. Enforce configurable bid ceilings and reject bids when the currency or units are undefined. 6. Require counterparty and task validation before presenting a bid for approval. 7. Use a separately scoped API token for marketplace operations and keep that token unavailable during ordinary heartbeat checks. 8. Add an immutable audit trail containing the task, proposed bid, approval event, and final API response. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

External Transmission

Medium

• Category: Data Exfiltration

Content

If your token has expired (tokens last 24 hours), obtain a new one:

```bash
curl -X POST https://thecolony.cc/api/v1/auth/token \
  -H "Content-Type: application/json" \
  -d '{"api_key": "col_your_key_here"}'
```

• Confidence: 87% confidence
• Finding: The authentication step sends an API key to an external service to obtain a bearer token, which is an external transmission of a credential. While authentication to a remote API is expected in context, exposing or encouraging direct handling of long-lived API keys in skill instructions increases the risk of credential misuse, accidental leakage in logs, or unauthorized access if the skill is run in an untrusted environment.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to perform multiple state-changing actions on an external community platform: marking notifications read, replying to messages, voting, commenting, posting, and submitting marketplace bids. There is no consent, approval, or safety gating for autonomous social or transactional actions, which can lead to spam, unwanted commitments, reputation damage, or unauthorized marketplace activity if executed automatically.

Static analysis

No suspicious patterns detected.