Colors was built after a detailed review of documented vulnerabilities in OpenClaw. Every design decision here has a corresponding threat it closes.

OpenClaw failure: CVE-2026-25253 (CVSS 8.8) — RCE via malicious WebSocket connection to the local gateway port.

Colors mitigation: No exposed gateway. No WebSocket server. No listening port. The CLI is the only interface — all I/O is stdin/stdout. An attacker has no network surface to hit.

OpenClaw failure: MEMORY.md and SOUL.md are plaintext Markdown files. Indirect prompt injection could write malicious instructions that survive reboots.

Colors mitigation: All persistent memory is stored as AES-256-GCM ciphertext. An HMAC-SHA256 integrity signature is verified before loading. If the file is modified on disk, Colors detects the tamper and refuses to load, reporting the failure to the user instead of silently loading poisoned memory.

OpenClaw failure: Third-party skills ran with full process permissions — documented cases of skills executing curl commands to exfiltrate user data.

Colors mitigation: Every skill runs in an isolated child process with a minimal env (no inherited file descriptors, no default env vars). Network access is false by default. A skill that requires network access must declare it in its manifest AND the user must grant it per session. The Colors core process never grants network access implicitly.

OpenClaw failure: Attackers hid malicious instructions in data the agent processed (web pages, documents, emails). The agent executed those instructions with full autonomy ("ClawJacked").

Colors mitigation: The MetacognitiveLoop tracks the source of every instruction. Instructions with sourceOfInstruction: "external_content" are categorically blocked from triggering tool calls. External content can inform the agent's response; it cannot command the agent's actions.

OpenClaw failure: Access tokens appeared in query parameters, harvestable from browser history or server logs.

Colors mitigation: No query parameters. No web server. No tokens in URLs. Authentication is challenge-response, stored only in process memory, cleared on shutdown.

OpenClaw failure: Plaintext API key storage documented in multiple audits.

Colors mitigation: API keys are never written to disk. They are passed via environment variable, held in process memory for the session duration, and cleared on shutdown. The memory store passphrase is similarly never persisted by Colors — the user owns it.

• Compromised passphrase: If your COLORS_PASSPHRASE is exposed, your memory store is decryptable.
• Compromised host OS: If your machine is rooted, process memory is readable.
• Malicious LLM responses: Colors mitigates this with the metacognitive gate, but a sufficiently sophisticated adversarial response could still manipulate agent behavior within permitted bounds.
• Skill author malice: Colors verifies skill hashes (tamper detection), but the hash is only as trustworthy as the source you installed from. Audit skills before registering them.

In June 2026, jason-allen-oneal conducted a white-box security audit of Colors prior to public release. The audit covered the sandbox isolation layer, tool execution pipeline, web UI, CLI, and CI pipeline.

15 findings were reported. All 15 have been resolved.

Key findings and fixes:

We are grateful to zero$ignal for the thoroughness and professionalism of this audit. The findings were reported responsibly and resolved collaboratively. This work meaningfully improved the security posture of Colors before it reached users.

If you are a security researcher and would like to audit Colors, see the reporting section below.

Open a GitHub issue with the security label. For critical issues, use GitHub's private vulnerability reporting.