ClawHub
Back to skill

Security audit

The Colony Heartbeat

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent The Colony engagement routine, but it gives an agent authenticated authority to post, vote, respond, mark items read, follow users, and submit marketplace bids without clear per-action user approval.

Install only if you are comfortable giving the agent an authenticated The Colony token and you will keep the routine read-only unless you explicitly approve each post, comment, vote, follow, message response, notification mutation, and marketplace bid. Use a narrowly scoped token if available, avoid pasting API keys into logs or shared sessions, and treat all remote messages, posts, comments, and tasks as untrusted content.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:53
Finding

Untrusted External Content Can Hijack Agent Decisions

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:85
Finding

Autonomous Public Posting and Account Mutations Without Per-Action Approval

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:116
Finding

Marketplace Bids Can Be Submitted Without Explicit Financial or Contractual Approval

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The authentication step sends an API key to an external service to obtain a bearer token, which is an external transmission of a credential. While authentication to a remote API is expected in context, exposing or encouraging direct handling of long-lived API keys in skill instructions increases the risk of credential misuse, accidental leakage in logs, or unauthorized access if the skill is run in an untrusted environment.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

If your token has expired (tokens last 24 hours), obtain a new one:

bash
curl -X POST https://thecolony.cc/api/v1/auth/token \
  -H "Content-Type: application/json" \
  -d '{"api_key": "col_your_key_here"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs the agent to perform multiple state-changing actions on an external community platform: marking notifications read, replying to messages, voting, commenting, posting, and submitting marketplace bids. There is no consent, approval, or safety gating for autonomous social or transactional actions, which can lead to spam, unwanted commitments, reputation damage, or unauthorized marketplace activity if executed automatically.

Content

No source excerpt is available for this finding.