ClawHub
Back to skill

Security audit

Colony Solana

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for a Solana game bot, but it can autonomously spend real crypto and exposes wallet/signing risks that users need to review carefully.

Install only with a dedicated low-balance Solana wallet, assume transactions are irreversible, avoid unattended swaps or spending without an external approval process, treat generated private-key output as sensitive, and review the Colony program authority model before funding the wallet.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T07 · Tool Hijacking and Spoofing

Error
Location
colony-cli.mjs:379
Finding

Blind Signing of Remotely Supplied Jupiter Transactions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
colony-cli.mjs:1153
Finding

Wallet Private Key Exposed Through Plaintext JSON Output

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
colony-cli.mjs:981
Finding

Documented Swap Spending Controls Are Not Enforced by the CLI

Content
View full analysis
= 0.01 SOL for transaction fees - **Swap caution**: Get a quote first (`swap-quote`) before executing swaps - **Large swaps**: Confirm with user before swapping > 1 SOL - **Price check**: Run `price` before swaps to verify token value - **Error recovery**: If a transaction fails, wait 30 seconds and retry once ``` ### Vulnerable Implementation ```js async function cmdSwap(solAmount) { if (!solAmount || solAmount <= 0) fail("--sol-amount must be > 0"); const keypair = requireKeypair(); try { const result = await jupiterSwap(keypair, solAmount); out({ ok: true, action: "swap", inputSol: result.inputAmount, outputOlo: result.outputAmount, priceImpact: result.priceImpact, signature: result.signature, }); } catch (err) { fail(`Swap failed: ${err.message}`); } } ``` ### Technical Analysis The Skill documentation requires explicit user confirmation for swaps exceeding 1 SOL and requires preservation of at least 0.01 SOL for fees. The executable implementation only verifies that the requested amount is positive. It does not: - Query the current SOL balance before executing the swap. - Preserve the documented 0.01 SOL reserve. - Reject or pause swaps above 1 SOL. - Require proof of explicit user confirmation. - Require the user to have executed `swap-quote`. - Enforce an acceptable price-impact threshold. - Impose a configurable per-transaction or cumulative spending cap. Natural-language safeguards are not a reliable security boundary for an autonomous agent. Prompt errors, malformed recommendations, automation defects, or direct CLI invocation can bypass them. ### Attack Path 1. An autonomous ...[truncated 1101 chars]
Remediation
View remediation

other

Error
Location
idl.json:787
Finding

Undisclosed Centralized Treasury Withdrawal and Mutable Token-Mint Controls

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The CLI loads SOLANA_PRIVATE_KEY from the environment and can immediately perform asset-moving operations such as swaps, token burns for land purchases, upgrades, and claims without any runtime confirmation, policy check, amount cap, or human approval step. In an autonomous agent setting, this makes accidental or malicious invocation highly dangerous because a single command can irreversibly spend funds or sign third-party supplied transactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The command output includes privateKey: secretKeyBase58 with only a mild instructional note, not a strong execution-time warning or safeguards. Exposed private keys can be copied by logs, terminal history, agent transcripts, or monitoring systems, enabling full theft of any funds later sent to that wallet.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The program includes explicit owner-only withdraw_sol and withdraw_tokens instructions, allowing the authority to drain the SOL vault and SPL token vault. Given the skill claims autonomous gameplay and token earning/claiming, this means deposited or accrued value can be exfiltrated by the owner at any time, making the treasury custodial and enabling a straightforward rug pull.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: bigint-buffer==1.1.5 — 1 advisory(ies): CVE-2025-3194 (bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function)

High
Category
Supply Chain
Confidence
89% confidence
Finding

The lockfile includes bigint-buffer 1.1.5, which is flagged for a buffer overflow in toBigIntLE(). Even though this is a transitive dependency used in Solana serialization tooling, malformed or attacker-controlled binary data could trigger memory-safety issues or process instability when parsing on-chain/network data.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
94% confidence
Finding

The lockfile includes ws 8.19.0, which is reported as vulnerable to uninitialized memory disclosure and memory-exhaustion DoS. This matters in a networked Solana skill because websocket connections are commonly used for RPC subscriptions, so a malicious or compromised endpoint could potentially leak memory contents or exhaust the agent process.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: toml==3.0.0 — 2 advisory(ies): CVE-2026-77465 (toml-node: Uncontrolled Recursion); CVE-2026-63376 (toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__pro)

High
Category
Supply Chain
Confidence
91% confidence
Finding

toml 3.0.0 is flagged for uncontrolled recursion and prototype pollution. Because Anchor depends on TOML parsing and skills often consume config-like data, parsing attacker-controlled TOML could corrupt Object.prototype or crash the process, which is especially concerning in an autonomous blockchain agent handling funds and external inputs.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
95% confidence
Finding

The lockfile includes ws 7.5.10, which is reported vulnerable to memory-exhaustion DoS from fragmented websocket frames. This is relevant because the dependency tree includes JSON-RPC/websocket components, and an autonomous Solana agent may maintain persistent connections to external services that could be abused to degrade availability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README advertises autonomous buying, upgrading, claiming, and token swapping on Solana without a clear risk disclosure that these actions spend real assets, can burn tokens, and may incur irreversible financial loss. Because the skill is specifically designed for unattended execution and strategy optimization, the absence of prominent warnings makes misuse and accidental loss more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README instructs users to place a Solana private key in an environment variable but gives no warning about key-handling risks, least-privilege usage, secret storage, or operational safeguards. In a skill that can autonomously execute on-chain actions, this increases the chance of wallet compromise or accidental exposure through shell history, process inspection, logs, CI systems, or misconfigured hosting environments.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill requires access to sensitive environment variables and external networked services, including a private key and RPC/Jupiter endpoints, but does not declare any explicit tool or permission scope. That creates a governance gap: an agent or platform may grant broader capabilities than the user realizes, increasing the chance of unintended secret exposure or unauthorized on-chain actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill describes the agent as an autonomous manager of a Solana game account and later defines an autonomous loop that includes claiming, swapping, buying, and upgrading assets without requiring per-action approval or bounded delegation. Because these are real on-chain transactions involving private keys and token value, unrestricted autonomy materially increases the risk of unintended spending, excessive trading, and repeated loss-causing actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The onboarding flow explicitly instructs the agent to ask the owner to fund a generated wallet with real SOL, but it does not present a clear risk disclosure or require an explicit confirmation checkpoint for a real-money transfer. In a crypto context this is especially risky because funds sent to the wrong address, a maliciously substituted address, or an untrusted strategy are typically irreversible.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · colony-cli.mjs (reported line 436)May include surrounding context.

js
async function jupiterQuote(solAmount) {
  requireJupiterKey();
  const lamports = Math.round(solAmount * 1_000_000_000);
  const url = `https://api.jup.ag/swap/v1/quote?inputMint=${SOL_MINT}&outputMint=${GAME_TOKEN_MINT}&amount=${lamports}&slippageBps=100`;
  const resp = await fetch(url, { headers: jupiterHeaders() });
  if (!resp.ok) {
    throw new Error(`Jupiter quote failed: ${resp.status} ${await resp.text()}`);

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · colony-cli.mjs (reported line 448)May include surrounding context.

js
async function jupiterQuote(solAmount) {
  requireJupiterKey();
  const lamports = Math.round(solAmount * 1_000_000_000);
  const url = `https://api.jup.ag/swap/v1/quote?inputMint=${SOL_MINT}&outputMint=${GAME_TOKEN_MINT}&amount=${lamports}&slippageBps=100`;
  const resp = await fetch(url, { headers: jupiterHeaders() });
  if (!resp.ok) {
    throw new Error(`Jupiter quote failed: ${resp.status} ${await resp.text()}`);

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · colony-cli.mjs (reported line 485)May include surrounding context.

js
async function jupiterQuote(solAmount) {
  requireJupiterKey();
  const lamports = Math.round(solAmount * 1_000_000_000);
  const url = `https://api.jup.ag/swap/v1/quote?inputMint=${SOL_MINT}&outputMint=${GAME_TOKEN_MINT}&amount=${lamports}&slippageBps=100`;
  const resp = await fetch(url, { headers: jupiterHeaders() });
  if (!resp.ok) {
    throw new Error(`Jupiter quote failed: ${resp.status} ${await resp.text()}`);

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · colony-cli.mjs (reported line 489)May include surrounding context.

js
async function jupiterQuote(solAmount) {
  requireJupiterKey();
  const lamports = Math.round(solAmount * 1_000_000_000);
  const url = `https://api.jup.ag/swap/v1/quote?inputMint=${SOL_MINT}&outputMint=${GAME_TOKEN_MINT}&amount=${lamports}&slippageBps=100`;
  const resp = await fetch(url, { headers: jupiterHeaders() });
  if (!resp.ok) {
    throw new Error(`Jupiter quote failed: ${resp.status} ${await resp.text()}`);

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · colony-cli.mjs (reported line 448)May include surrounding context.

js
requireJupiterKey();
  const quote = await jupiterQuote(solAmount);

  const swapResp = await fetch("https://api.jup.ag/swap/v1/swap", {
    method: "POST",
    headers: jupiterHeaders(),
    body: JSON.stringify({

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The generate-wallet command creates a new Solana keypair and prints the private key directly to stdout in JSON. In an agent/tooling context, stdout is commonly captured in logs, traces, chat history, or orchestration systems, so this exposes secret material far beyond the intended recipient. This capability is not necessary for routine gameplay and expands the skill from game interaction into unsafe wallet management.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The IDL exposes multiple privileged instructions unrelated to ordinary gameplay, including withdrawing SOL/tokens, changing the token mint, pausing the game, and closing user/land accounts. In the context of an autonomous gameplay skill, these capabilities materially expand what the agent could invoke and create a clear rug-pull/admin-abuse path where user assets, rewards, or state can be seized or invalidated by the program authority.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file begins by presenting the program as a normal game IDL, while destructive admin operations later allow closing land accounts, user profiles, and the token vault. Without prominent warnings about irreversible state deletion and authority seizure powers, users and integrators may treat the skill as ordinary gameplay automation and unknowingly interact with a system where the admin can destroy or reset critical state.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: stream-json==1.9.1 — 1 advisory(ies): CVE-2026-71429 (stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — )

Low
Category
Supply Chain
Confidence
77% confidence
Finding

stream-json 1.9.1 is flagged for O(depth²) behavior on deeply nested input, which can enable denial of service via CPU amplification. In this package-lock context it is a transitive dependency and likely not a primary code path for the gameplay skill, so the risk is real but comparatively limited unless untrusted nested JSON is processed.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: uuid==8.3.2 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low
Category
Supply Chain
Confidence
68% confidence
Finding

uuid 8.3.2 is reported to lack bounds checks in some hash-based UUID functions when a buffer argument is supplied. This is a genuine dependency risk, but its exploitability here appears limited because it requires specific API usage and this lockfile alone does not show the skill invoking the affected code paths on attacker-controlled inputs.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency is version-ranged with a caret, so installs may pull newer minor or patch releases than originally tested. In a wallet/game automation skill that signs Solana transactions, unexpected upstream changes or a compromised release could affect transaction construction or key-handling behavior and increase supply-chain risk.

Content

Scanner excerpt · package.json (reported line 7)May include surrounding context.

json
"private": true,
  "type": "module",
  "dependencies": {
    "@coral-xyz/anchor": "^0.32.1",
    "@solana/web3.js": "^1.98.0",
    "@solana/spl-token": "^0.4.9",
    "bs58": "^6.0.0"

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

Using a caret range for @solana/web3.js allows non-identical builds over time, which is risky for software that interacts with blockchain accounts and submits signed transactions. If a later compatible-seeming release introduces a regression or malicious code through the supply chain, the skill could behave differently than audited.

Content

Scanner excerpt · package.json (reported line 8)May include surrounding context.

json
"type": "module",
  "dependencies": {
    "@coral-xyz/anchor": "^0.32.1",
    "@solana/web3.js": "^1.98.0",
    "@solana/spl-token": "^0.4.9",
    "bs58": "^6.0.0"
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The caret version on @solana/spl-token means the resolved package may drift from the reviewed version, which can impact token transfer, account, or mint operations. In this skill's Solana token-management context, dependency drift increases the chance of transaction errors or exploitation through a compromised package release.

Content

Scanner excerpt · package.json (reported line 9)May include surrounding context.

json
"dependencies": {
    "@coral-xyz/anchor": "^0.32.1",
    "@solana/web3.js": "^1.98.0",
    "@solana/spl-token": "^0.4.9",
    "bs58": "^6.0.0"
  }
}

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
colony-cli.mjs:114