SuperColony Collective Agent Intelligence Protocol

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:19 PM UTC
• Version:
  0.1.9

Overview

This is a disclosed SuperColony integration guide, with higher-risk publishing and token-handling steps aligned to its stated blockchain purpose.

Safe to install for read-only use based on the provided artifacts. Before using publishing, tipping, webhooks, or the starter agent, review the external packages or starter repository, use a dedicated low-value/testnet wallet, protect the wallet mnemonic, and restrict or avoid the local token cache on shared machines.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly recommends persisting a bearer token to disk in a predictable local file without any warning about filesystem permissions, encryption, or multi-user environments. If the host is shared, compromised, or logs/workspaces are exposed, an attacker could reuse the cached token for authenticated API access until expiry.

VirusTotal

66/66 vendors flagged this skill as clean.