ClawHub
Back to skill

Security audit

colorpool skills

Security checks for vulnerabilities and agentic risk

Overview

This ColorPool DEX skill is transparent about what it does, but it gives an agent raw signing-key access for token swaps and transfers without strong transaction-confirmation boundaries.

Install only if you are comfortable letting the agent use a local Chromia private key to sign real ColorPool transactions. Use a dedicated low-balance key, review every swap or transfer before broadcast, verify recipient and slippage values manually, and prefer an external signer or wallet flow if available.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

Credential Access

High
Category
Privilege Escalation
Content
required: true
credentials:
  - name: ColorPool Credentials
    path: "~/.config/colorpool/credentials.json"
    description: "Chromia keypair (privKey + pubKey in hex) for signing ColorPool transactions. This may be the same keypair as your ClawChain credentials, or a separate one for ColorPool. Used only locally by Chromia CLI for signing — never sent over the network."
    access: read
  - name: ClawChain Credentials (for account lookup)
Confidence
82% confidence
Finding
The skill explicitly requests read access to a local credentials file containing a Chromia private key used to sign transactions. Even if the stated purpose is local signing, exposing a raw private-key file to an agent skill materially increases the blast radius of prompt injection, logging mistakes, or future skill misuse, because compromise of that file enables unauthorized asset transfers.

Credential Access

High
Category
Privilege Escalation
Content
description: "Chromia keypair (privKey + pubKey in hex) for signing ColorPool transactions. This may be the same keypair as your ClawChain credentials, or a separate one for ColorPool. Used only locally by Chromia CLI for signing — never sent over the network."
    access: read
  - name: ClawChain Credentials (for account lookup)
    path: "~/.config/clawchain/credentials.json"
    description: "Chromia keypair used for looking up your account ID. Created by the clawchain skill. Read-only access — this skill does not modify it."
    access: read
    optional: true
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
description: "Chromia keypair (privKey + pubKey in hex) for signing ColorPool transactions. This may be the same keypair as your ClawChain credentials, or a separate one for ColorPool. Used only locally by Chromia CLI for signing — never sent over the network."
    access: read
  - name: ClawChain Credentials (for account lookup)
    path: "~/.config/clawchain/credentials.json"
    description: "Chromia keypair used for looking up your account ID. Created by the clawchain skill. Read-only access — this skill does not modify it."
    access: read
    optional: true
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
description: "Chromia keypair (privKey + pubKey in hex) for signing ColorPool transactions. This may be the same keypair as your ClawChain credentials, or a separate one for ColorPool. Used only locally by Chromia CLI for signing — never sent over the network."
    access: read
  - name: ClawChain Credentials (for account lookup)
    path: "~/.config/clawchain/credentials.json"
    description: "Chromia keypair used for looking up your account ID. Created by the clawchain skill. Read-only access — this skill does not modify it."
    access: read
    optional: true
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Ae1

High
Category
analysis-evasion
Content
- It does **not** manage ClawChain social network operations. For that, see `skill.md` or `curl_skills.md`.
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Credential Access

High
Category
Privilege Escalation
Content
| File | Access | Purpose |
|------|--------|---------|
| `~/.config/colorpool/credentials.json` | Read (used for `--secret` flag) | Chromia keypair for signing swap transactions via CLI |
| `~/.config/clawchain/credentials.json` | Read-only (optional) | Used to look up your account ID from your pubkey |

### Transparency: Network Calls
Confidence
82% confidence
Finding
The transparency table confirms the skill reads `~/.config/colorpool/credentials.json` for transaction signing. Reading a file that contains a signing key is a sensitive capability: if the agent, toolchain, or logs are compromised, an attacker can gain signing authority and steal or move funds.

Credential Access

High
Category
Privilege Escalation
Content
'[0, [["A","T"], x"<YOUR_PUBKEY>"], null]' \
  'null' \
  --ft-register-account \
  --secret ~/.config/colorpool/credentials.json \
  -brid $COLORPOOL_BRID \
  --api-url $COLORPOOL_NODE \
  --await
Confidence
90% confidence
Finding
This command uses `--secret ~/.config/colorpool/credentials.json` to sign an on-chain transaction, meaning the skill workflow depends on direct access to private-key material. In an autonomous-agent setting, this is dangerous because any compromise or misuse of the agent can immediately result in unauthorized account registration or fund-moving transactions.

Credential Access

High
Category
Privilege Escalation
Content
```bash
chr tx <operation> "value1" "value2" "value3" \
  --ft-auth \
  --secret ~/.config/colorpool/credentials.json \
  -brid $COLORPOOL_BRID \
  --api-url $COLORPOOL_NODE \
  --await
Confidence
90% confidence
Finding
The generic operations pattern normalizes passing the secret key file to every state-changing transaction. This creates a reusable pathway for arbitrary on-chain actions if the agent is tricked into invoking unsafe commands, greatly increasing the risk of unauthorized transfers or swaps.

Credential Access

High
Category
Privilege Escalation
Content
'["CHR", "USDT"]' \
  "<YOUR_ACCOUNT_ID>" \
  1735689600 \
  --ft-auth --secret ~/.config/colorpool/credentials.json \
  -brid $COLORPOOL_BRID --api-url $COLORPOOL_NODE --await
```
Use the `amount_out_min` from the quote (with slippage applied), not a guess.
Confidence
91% confidence
Finding
The concrete swap example includes direct secret-file signing for a financial transaction that can irreversibly exchange assets. In a DEX skill, this is especially sensitive because the same capability can be abused to drain balances or perform unfavorable trades under manipulated prompts.

Credential Access

High
Category
Privilege Escalation
Content
### Credential Storage

- `~/.config/colorpool/credentials.json` contains your Chromia keypair for ColorPool. Protect it with `chmod 600`.
- The private key is used **only locally** by Chromia CLI to sign transactions. It is **never sent over the network**.
- The `--secret` flag tells `chr` where to find the keypair for signing — the CLI handles signing in-memory.
Confidence
83% confidence
Finding
The credential storage section confirms that the referenced file contains the Chromia keypair, including the private key. While the text encourages protection, it also establishes that the skill’s trust boundary includes raw secret material, which is a significant security risk in an agent environment.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill enables swaps, transfers, and cross-chain transfers of real assets but does not clearly warn that blockchain transactions can be irreversible and funds may be permanently lost due to mistakes, slippage, or wrong recipient details. In a financial trading skill, missing explicit user-risk language increases the chance an agent executes high-impact actions without sufficiently informed confirmation.

Session Persistence

Medium
Category
Rogue Agent
Content
4. In To address, paste your account id: `<ACCOUNT_ID_FROM_QUERY>`
5. Confirm the transfer

### 2. Create FT4 Account

```bash
chr tx ft4.ras_transfer_fee \
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
### Credential Storage

- `~/.config/colorpool/credentials.json` contains your Chromia keypair for ColorPool. Protect it with `chmod 600`.
- The private key is used **only locally** by Chromia CLI to sign transactions. It is **never sent over the network**.
- The `--secret` flag tells `chr` where to find the keypair for signing — the CLI handles signing in-memory.
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.