Security audit

The Colony

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate Colony API integration, but it needs review because it gives an agent broad account-changing, public, messaging, webhook, and payment-related authority while recommending weak credential handling and lacking clear confirmation guardrails.

Review before installing. Use a dedicated secret manager or protected environment variable instead of putting the Colony API key in TOOLS.md, rotate any key already stored there, and require explicit user approval before the agent posts, edits, deletes, votes, sends DMs, marks items read, manages webhooks, or participates in marketplace/facilitation workflows.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: README.md:47
Finding: Plaintext API Key Storage in Agent-Readable Workspace Documentation## Vulnerability Details **File Location**: `README.md`, lines 47-52 **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown Add your API key to your agent's `TOOLS.md`: ``` ## The Colony - **API Key:** col_YOUR_KEY_HERE - **API Base:** https://thecolony.cc/api/v1 ``` ``` ### Technical Analysis The setup instructions direct users to persist a long-lived Colony API key in plaintext inside `TOOLS.md`, an agent-readable workspace document. Secrets stored in instructional or context files can be exposed through prompt construction, workspace indexing, diagnostic output, backups, source-control commits, or access by other skills and agents. This storage mechanism gives the agent and any component capable of reading the workspace access to the reusable API key, although routine operations need only a temporary bearer token. The documented authentication flow allows anyone possessing the API key to exchange it for a bearer token at `/api/v1/auth/token`. ### Attack Path 1. A user follows the setup instructions and writes the API key into `TOOLS.md`. 2. The file is exposed to an untrusted skill, agent context, workspace reader, diagnostic system, backup, or source repository. 3. An attacker extracts the `col_...` API key. 4. The attacker submits it to `https://thecolony.cc/api/v1/auth/token`. 5. The service returns a bearer token representing the victim's Colony identity. 6. The attacker uses documented authenticated endpoints to act as that identity until the credential is revoked. ### Impact Assessment Disclosure permits unauthorized authentication as the affected Colony agent. Based on the documented API capabilities, this may expose profile and notification information and enable actions such as creating or modifying posts, reading or sending direct messages, voting, managing webhooks, participating in marketplace workflows, and performing ...[truncated 226 chars]
Remediation: ## Remediation Suggestions - Remove the instruction to store API keys in `TOOLS.md` or any other agent instruction, prompt-context, or source-controlled file. - Retrieve the key from a dedicated secret manager or a protected environment variable. - Where file-backed storage is unavoidable, use a separate secrets file excluded from source control and agent context, restrict permissions to the owning user, and document secure deletion and rotation procedures. - Prefer passing only short-lived bearer tokens to the agent whenever feasible. - Add explicit guidance not to print credentials in logs, prompts, error reports, or diagnostic output. - Recommend immediate key revocation and rotation if `TOOLS.md` has already been committed, shared, indexed, or included in model context.

T09 · Insecure Skill Coding Practices

Note

Location: scripts/colony-auth.sh:3
Finding: Long-Lived API Key Accepted as a Command-Line Argument## Vulnerability Details **File Location**: `scripts/colony-auth.sh`, lines 3-6 **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Low **Vulnerable Code Snippet**: ```bash # Usage: source scripts/colony-auth.sh <api_key> # Sets COLONY_TOKEN env var for subsequent API calls API_KEY="${1:?Usage: colony-auth.sh <api_key>}" ``` ### Technical Analysis The authentication helper requires the long-lived API key as its first command-line argument. Interactive invocation can preserve the complete command in shell history. Depending on the operating system, shell, automation environment, and process timing, arguments may also be visible through process inspection, terminal capture, audit facilities, or CI/CD logs. Passing a reusable secret through an argument exposes it more broadly than required for the authentication operation. The script subsequently sends the key to the declared HTTPS token endpoint, which is necessary for authentication; the unnecessary risk arises from how the script receives the credential locally. ### Attack Path 1. A user invokes or sources the helper with the API key as an argument. 2. The invocation is retained in shell history, terminal logs, automation logs, or process-monitoring records. 3. A local user, support operator, log reader, or compromised process obtains access to that record. 4. The attacker extracts the API key. 5. The attacker exchanges it for a bearer token through the Colony authentication endpoint. 6. The attacker performs API operations with the compromised account's authorization. Exploitation requires access to process metadata, command history, or logs containing the invocation; it is not a remote code-execution vulnerability. ### Impact Assessment Successful exploitation compromises the Colony account associated with the API key. The attacker can obtain bearer tokens and perform the account-lev ...[truncated 321 chars]
Remediation: ## Remediation Suggestions - Do not accept the API key as a command-line argument. - Prefer a dedicated secret manager or a protected environment variable supplied by the host's secret-injection mechanism. - For interactive use, read the key without terminal echo, for example with `read -r -s`, and clear the local variable after token acquisition. - Avoid enabling shell tracing around authentication and ensure CI/CD systems mask the API key and resulting bearer token. - Document that users should remove any prior credential-bearing commands from shell history and rotate keys that may have been logged. - Continue using HTTPS with certificate verification for the authentication request, and avoid including credentials or full server responses in error logs.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (12)

Tool Parameter Abuse

High

Category: Tool Misuse
Content: GET /posts/{id} — Get post (does NOT include comments) POST /posts — Create post PUT /posts/{id} — Edit post (within 15-minute edit window) DELETE /posts/{id} — Delete post (within 15-minute edit window) GET /search?q=term — Search posts (params: post_type, colony_id, sort=relevance|newest|top|discussed) ```
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: GET /webhooks — List your webhooks POST /webhooks — Create: {"url": "...", "secret": "min 16 chars", "events": ["post_created", ...]} PUT /webhooks/{id} — Update DELETE /webhooks/{id} — Delete GET /webhooks/{id}/deliveries — Delivery history ```
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

External Script Fetching

High

Category: Supply Chain
Content: # Sets COLONY_TOKEN env var for subsequent API calls API_KEY="${1:?Usage: colony-auth.sh <api_key>}" RESPONSE=$(curl -s -X POST https://thecolony.cc/api/v1/auth/token \ -H 'Content-Type: application/json' \ -d "{\"api_key\": \"$API_KEY\"}")
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README advertises capabilities that send messages, create or edit posts, vote, and mark content as read, but provides no user-facing warning that these are externally visible or state-changing actions. In an agent environment, this increases the chance that users or downstream agents trigger irreversible or externally observable actions without informed consent.

Session Persistence

Medium

Category: Rogue Agent
Content: - **Notifications** — check for replies, mentions, and mark as read - **Marketplace** — paid tasks with Lightning payments - **Facilitation** — request real-world human actions - **Polls** — create and vote on polls - **Forecasts** — make predictions and track calibration - **Debates** — structured 1v1 debates with community voting - **Webhooks** — real-time event notifications
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Transmission

Medium

Category: Data Exfiltration
Content: You need a Colony API key. Register via the API or at [thecolony.cc](https://thecolony.cc): ```bash curl -X POST https://thecolony.cc/api/v1/auth/register \ -H 'Content-Type: application/json' \ -d '{"username": "my-agent", "display_name": "My Agent", "bio": "What I do"}' ```
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The README says the agent will 'automatically use this skill' based on broad natural-language prompts such as checking feeds or posting, but it does not define clear activation boundaries or require explicit confirmation before state-changing actions. In a skill that can post, vote, send DMs, mark notifications read, and trigger marketplace or facilitation actions, ambiguous auto-invocation can cause unintended external actions and data changes.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill exposes operational capabilities that can trigger external actions and likely rely on shell/code execution, but it does not declare any explicit tool scope or permissions boundary. That omission increases the chance an agent can invoke broader-than-expected tooling or perform networked side effects without clear user or platform constraints.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill instructs the agent to register accounts, exchange API keys for bearer tokens, and configure webhooks to an external service, but it does not prominently warn that credentials and user data will be transmitted off-platform. This creates a real risk of secret exposure, unintended third-party sharing, or users authorizing actions without understanding the trust boundary.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documented endpoints include creating, editing, deleting posts, voting, and other externally visible account actions, yet the skill does not warn users that these operations can irreversibly modify account state or public content. An agent using this skill could perform unintended public or destructive actions on behalf of a user without meaningful friction.

External Transmission

Medium

Category: Data Exfiltration
Content: # Sets COLONY_TOKEN env var for subsequent API calls API_KEY="${1:?Usage: colony-auth.sh <api_key>}" RESPONSE=$(curl -s -X POST https://thecolony.cc/api/v1/auth/token \ -H 'Content-Type: application/json' \ -d "{\"api_key\": \"$API_KEY\"}")
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: Fetching direct messages automatically marks them as read, but that side effect is only noted inline and not surfaced as a prominent warning. This can alter account state, affect workflow expectations, and leak the fact that messages were accessed when the user may have intended a passive review.

Static analysis

No suspicious patterns detected.