colorpool skills

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:35 PM UTC
• Version: 1.0.1

Overview

This ColorPool DEX skill is transparent about what it does, but it gives an agent raw signing-key access for token swaps and transfers without strong transaction-confirmation boundaries.

Install only if you are comfortable letting the agent use a local Chromia private key to sign real ColorPool transactions. Use a dedicated low-balance key, review every swap or transfer before broadcast, verify recipient and slippage values manually, and prefer an external signer or wallet flow if available.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 82% confidence

Finding

The skill explicitly requests read access to a local credentials file containing a Chromia private key used to sign transactions. Even if the stated purpose is local signing, exposing a raw private-key file to an agent skill materially increases the blast radius of prompt injection, logging mistakes, or future skill misuse, because compromise of that file enables unauthorized asset transfers.

Content

Scanner excerpt · skill.md (reported line 25)May include surrounding context.

md

required: true
credentials:
  - name: ColorPool Credentials
    path: "~/.config/colorpool/credentials.json"
    description: "Chromia keypair (privKey + pubKey in hex) for signing ColorPool transactions. This may be the same keypair as your ClawChain credentials, or a separate one for ColorPool. Used only locally by Chromia CLI for signing — never sent over the network."
    access: read
  - name: ClawChain Credentials (for account lookup)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 29)May include surrounding context.

md

description: "Chromia keypair (privKey + pubKey in hex) for signing ColorPool transactions. This may be the same keypair as your ClawChain credentials, or a separate one for ColorPool. Used only locally by Chromia CLI for signing — never sent over the network."
    access: read
  - name: ClawChain Credentials (for account lookup)
    path: "~/.config/clawchain/credentials.json"
    description: "Chromia keypair used for looking up your account ID. Created by the clawchain skill. Read-only access — this skill does not modify it."
    access: read
    optional: true

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 64)May include surrounding context.

md

description: "Chromia keypair (privKey + pubKey in hex) for signing ColorPool transactions. This may be the same keypair as your ClawChain credentials, or a separate one for ColorPool. Used only locally by Chromia CLI for signing — never sent over the network."
    access: read
  - name: ClawChain Credentials (for account lookup)
    path: "~/.config/clawchain/credentials.json"
    description: "Chromia keypair used for looking up your account ID. Created by the clawchain skill. Read-only access — this skill does not modify it."
    access: read
    optional: true

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 112)May include surrounding context.

md

description: "Chromia keypair (privKey + pubKey in hex) for signing ColorPool transactions. This may be the same keypair as your ClawChain credentials, or a separate one for ColorPool. Used only locally by Chromia CLI for signing — never sent over the network."
    access: read
  - name: ClawChain Credentials (for account lookup)
    path: "~/.config/clawchain/credentials.json"
    description: "Chromia keypair used for looking up your account ID. Created by the clawchain skill. Read-only access — this skill does not modify it."
    access: read
    optional: true

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · skill.md (reported line 56)May include surrounding context.

md

- It does **not** manage ClawChain social network operations. For that, see `skill.md` or `curl_skills.md`.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 82% confidence

Finding

The transparency table confirms the skill reads ~/.config/colorpool/credentials.json for transaction signing. Reading a file that contains a signing key is a sensitive capability: if the agent, toolchain, or logs are compromised, an attacker can gain signing authority and steal or move funds.

Content

Scanner excerpt · skill.md (reported line 63)May include surrounding context.

md

| File | Access | Purpose |
|------|--------|---------|
| `~/.config/colorpool/credentials.json` | Read (used for `--secret` flag) | Chromia keypair for signing swap transactions via CLI |
| `~/.config/clawchain/credentials.json` | Read-only (optional) | Used to look up your account ID from your pubkey |

### Transparency: Network Calls

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This command uses --secret ~/.config/colorpool/credentials.json to sign an on-chain transaction, meaning the skill workflow depends on direct access to private-key material. In an autonomous-agent setting, this is dangerous because any compromise or misuse of the agent can immediately result in unauthorized account registration or fund-moving transactions.

Content

Scanner excerpt · skill.md (reported line 167)May include surrounding context.

md

'[0, [["A","T"], x"<YOUR_PUBKEY>"], null]' \
  'null' \
  --ft-register-account \
  --secret ~/.config/colorpool/credentials.json \
  -brid $COLORPOOL_BRID \
  --api-url $COLORPOOL_NODE \
  --await

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The generic operations pattern normalizes passing the secret key file to every state-changing transaction. This creates a reusable pathway for arbitrary on-chain actions if the agent is tricked into invoking unsafe commands, greatly increasing the risk of unauthorized transfers or swaps.

Content

Scanner excerpt · skill.md (reported line 193)May include surrounding context.

bash

chr tx <operation> "value1" "value2" "value3" \
  --ft-auth \
  --secret ~/.config/colorpool/credentials.json \
  -brid $COLORPOOL_BRID \
  --api-url $COLORPOOL_NODE \
  --await

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The concrete swap example includes direct secret-file signing for a financial transaction that can irreversibly exchange assets. In a DEX skill, this is especially sensitive because the same capability can be abused to drain balances or perform unfavorable trades under manipulated prompts.

Content

Scanner excerpt · skill.md (reported line 375)May include surrounding context.

'["CHR", "USDT"]'
"<YOUR_ACCOUNT_ID>"
1735689600
--ft-auth --secret ~/.config/colorpool/credentials.json
-brid $COLORPOOL_BRID --api-url $COLORPOOL_NODE --await

text

Use the `amount_out_min` from the quote (with slippage applied), not a guess.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The credential storage section confirms that the referenced file contains the Chromia keypair, including the private key. While the text encourages protection, it also establishes that the skill’s trust boundary includes raw secret material, which is a significant security risk in an agent environment.

Content

Scanner excerpt · skill.md (reported line 430)May include surrounding context.

md

### Credential Storage

- `~/.config/colorpool/credentials.json` contains your Chromia keypair for ColorPool. Protect it with `chmod 600`.
- The private key is used **only locally** by Chromia CLI to sign transactions. It is **never sent over the network**.
- The `--secret` flag tells `chr` where to find the keypair for signing — the CLI handles signing in-memory.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill enables swaps, transfers, and cross-chain transfers of real assets but does not clearly warn that blockchain transactions can be irreversible and funds may be permanently lost due to mistakes, slippage, or wrong recipient details. In a financial trading skill, missing explicit user-risk language increases the chance an agent executes high-impact actions without sufficiently informed confirmation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · skill.md (reported line 159)May include surrounding context.

4. In To address, paste your account id: <ACCOUNT_ID_FROM_QUERY>
5. Confirm the transfer

2. Create FT4 Account

bash

chr tx ft4.ras_transfer_fee \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.md (reported line 430)May include surrounding context.

md

### Credential Storage

- `~/.config/colorpool/credentials.json` contains your Chromia keypair for ColorPool. Protect it with `chmod 600`.
- The private key is used **only locally** by Chromia CLI to sign transactions. It is **never sent over the network**.
- The `--secret` flag tells `chr` where to find the keypair for signing — the CLI handles signing in-memory.