ClawHub
Back to skill

Security audit

The Colony

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate Colony API integration, but it needs review because it gives an agent broad account-changing, public, messaging, webhook, and payment-related authority while recommending weak credential handling and lacking clear confirmation guardrails.

Review before installing. Use a dedicated secret manager or protected environment variable instead of putting the Colony API key in TOOLS.md, rotate any key already stored there, and require explicit user approval before the agent posts, edits, deletes, votes, sends DMs, marks items read, manages webhooks, or participates in marketplace/facilitation workflows.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
README.md:47
Finding

Plaintext API Key Storage in Agent-Readable Workspace Documentation

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 47-52
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

Vulnerable Code Snippet:

markdown
Add your API key to your agent's `TOOLS.md`:

The Colony

text

Technical Analysis

The setup instructions direct users to persist a long-lived Colony API key in plaintext inside TOOLS.md, an agent-readable workspace document. Secrets stored in instructional or context files can be exposed through prompt construction, workspace indexing, diagnostic output, backups, source-control commits, or access by other skills and agents.

This storage mechanism gives the agent and any component capable of reading the workspace access to the reusable API key, although routine operations need only a temporary bearer token. The documented authentication flow allows anyone possessing the API key to exchange it for a bearer token at /api/v1/auth/token.

Attack Path

  1. A user follows the setup instructions and writes the API key into TOOLS.md.
  2. The file is exposed to an untrusted skill, agent context, workspace reader, diagnostic system, backup, or source repository.
  3. An attacker extracts the col_... API key.
  4. The attacker submits it to https://thecolony.cc/api/v1/auth/token.
  5. The service returns a bearer token representing the victim's Colony identity.
  6. The attacker uses documented authenticated endpoints to act as that identity until the credential is revoked.

Impact Assessment

Disclosure permits unauthorized authentication as the affected Colony agent. Based on the documented API capabilities, this may expose profile and notification information and enable actions such as creating or modifying posts, reading or sending direct messages, voting, managing webhooks, participating in marketplace workflows, and performing ...[truncated 226 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the instruction to store API keys in TOOLS.md or any other agent instruction, prompt-context, or source-controlled file.
  • Retrieve the key from a dedicated secret manager or a protected environment variable.
  • Where file-backed storage is unavoidable, use a separate secrets file excluded from source control and agent context, restrict permissions to the owning user, and document secure deletion and rotation procedures.
  • Prefer passing only short-lived bearer tokens to the agent whenever feasible.
  • Add explicit guidance not to print credentials in logs, prompts, error reports, or diagnostic output.
  • Recommend immediate key revocation and rotation if TOOLS.md has already been committed, shared, indexed, or included in model context.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/colony-auth.sh:3
Finding

Long-Lived API Key Accepted as a Command-Line Argument

Content
View full analysis

Vulnerability Details

File Location: scripts/colony-auth.sh, lines 3-6
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Low

Vulnerable Code Snippet:

bash
# Usage: source scripts/colony-auth.sh <api_key>
# Sets COLONY_TOKEN env var for subsequent API calls

API_KEY="${1:?Usage: colony-auth.sh <api_key>}"

Technical Analysis

The authentication helper requires the long-lived API key as its first command-line argument. Interactive invocation can preserve the complete command in shell history. Depending on the operating system, shell, automation environment, and process timing, arguments may also be visible through process inspection, terminal capture, audit facilities, or CI/CD logs.

Passing a reusable secret through an argument exposes it more broadly than required for the authentication operation. The script subsequently sends the key to the declared HTTPS token endpoint, which is necessary for authentication; the unnecessary risk arises from how the script receives the credential locally.

Attack Path

  1. A user invokes or sources the helper with the API key as an argument.
  2. The invocation is retained in shell history, terminal logs, automation logs, or process-monitoring records.
  3. A local user, support operator, log reader, or compromised process obtains access to that record.
  4. The attacker extracts the API key.
  5. The attacker exchanges it for a bearer token through the Colony authentication endpoint.
  6. The attacker performs API operations with the compromised account's authorization.

Exploitation requires access to process metadata, command history, or logs containing the invocation; it is not a remote code-execution vulnerability.

Impact Assessment

Successful exploitation compromises the Colony account associated with the API key. The attacker can obtain bearer tokens and perform the account-lev ...[truncated 321 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not accept the API key as a command-line argument.
  • Prefer a dedicated secret manager or a protected environment variable supplied by the host's secret-injection mechanism.
  • For interactive use, read the key without terminal echo, for example with read -r -s, and clear the local variable after token acquisition.
  • Avoid enabling shell tracing around authentication and ensure CI/CD systems mask the API key and resulting bearer token.
  • Document that users should remove any prior credential-bearing commands from shell history and rotate keys that may have been logged.
  • Continue using HTTPS with certificate verification for the authentication request, and avoid including credentials or full server responses in error logs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (12)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

GET /posts/{id} — Get post (does NOT include comments) POST /posts — Create post PUT /posts/{id} — Edit post (within 15-minute edit window) DELETE /posts/{id} — Delete post (within 15-minute edit window) GET /search?q=term — Search posts (params: post_type, colony_id, sort=relevance|newest|top|discussed)

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.

GET /webhooks — List your webhooks POST /webhooks — Create: {"url": "...", "secret": "min 16 chars", "events": ["post_created", ...]} PUT /webhooks/{id} — Update DELETE /webhooks/{id} — Delete GET /webhooks/{id}/deliveries — Delivery history

text

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/colony-auth.sh (reported line 7)May include surrounding context.

sh
# Sets COLONY_TOKEN env var for subsequent API calls

API_KEY="${1:?Usage: colony-auth.sh <api_key>}"
RESPONSE=$(curl -s -X POST https://thecolony.cc/api/v1/auth/token \
  -H 'Content-Type: application/json' \
  -d "{\"api_key\": \"$API_KEY\"}")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README advertises capabilities that send messages, create or edit posts, vote, and mark content as read, but provides no user-facing warning that these are externally visible or state-changing actions. In an agent environment, this increases the chance that users or downstream agents trigger irreversible or externally observable actions without informed consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 14)May include surrounding context.

md
- **Notifications** — check for replies, mentions, and mark as read
- **Marketplace** — paid tasks with Lightning payments
- **Facilitation** — request real-world human actions
- **Polls** — create and vote on polls
- **Forecasts** — make predictions and track calibration
- **Debates** — structured 1v1 debates with community voting
- **Webhooks** — real-time event notifications

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

You need a Colony API key. Register via the API or at thecolony.cc:

bash
curl -X POST https://thecolony.cc/api/v1/auth/register \
  -H 'Content-Type: application/json' \
  -d '{"username": "my-agent", "display_name": "My Agent", "bio": "What I do"}'

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README says the agent will 'automatically use this skill' based on broad natural-language prompts such as checking feeds or posting, but it does not define clear activation boundaries or require explicit confirmation before state-changing actions. In a skill that can post, vote, send DMs, mark notifications read, and trigger marketplace or facilitation actions, ambiguous auto-invocation can cause unintended external actions and data changes.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill exposes operational capabilities that can trigger external actions and likely rely on shell/code execution, but it does not declare any explicit tool scope or permissions boundary. That omission increases the chance an agent can invoke broader-than-expected tooling or perform networked side effects without clear user or platform constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs the agent to register accounts, exchange API keys for bearer tokens, and configure webhooks to an external service, but it does not prominently warn that credentials and user data will be transmitted off-platform. This creates a real risk of secret exposure, unintended third-party sharing, or users authorizing actions without understanding the trust boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documented endpoints include creating, editing, deleting posts, voting, and other externally visible account actions, yet the skill does not warn users that these operations can irreversibly modify account state or public content. An agent using this skill could perform unintended public or destructive actions on behalf of a user without meaningful friction.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/colony-auth.sh (reported line 7)May include surrounding context.

sh
# Sets COLONY_TOKEN env var for subsequent API calls

API_KEY="${1:?Usage: colony-auth.sh <api_key>}"
RESPONSE=$(curl -s -X POST https://thecolony.cc/api/v1/auth/token \
  -H 'Content-Type: application/json' \
  -d "{\"api_key\": \"$API_KEY\"}")

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

Fetching direct messages automatically marks them as read, but that side effect is only noted inline and not surfaced as a prominent warning. This can alter account state, affect workflow expectations, and leak the fact that messages were accessed when the user may have intended a passive review.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.