Security audit
Security checks for vulnerabilities and agentic risk
This skill has notable local storage and local server behavior, but the artifacts disclose those capabilities and I found no evidence of deception, exfiltration, destructive code, or privilege escalation.
Install only if you are comfortable with a skill that writes local state under OpenClaw-related directories and may run a local Python MCP helper. Review or clear its storage if you pass sensitive context or embeddings, and expect some functionality may not work without the missing Python core files.
The skill is presented as an autonomous self-evolving system, but the documented interface exposes persistent storage operations and CRUD-like skill management that are not clearly reflected in the description. This concealment increases risk because users may not realize the skill can save, load, enumerate, and manage locally persisted data beyond transient analysis.
The skill is presented as an autonomous self-evolving system, but the documented interface exposes persistent storage operations and CRUD-like skill management that are not clearly reflected in the description. This concealment increases risk because users may not realize the skill can save, load, enumerate, and manage locally persisted data beyond transient analysis.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
python3 ~/.openclaw/skills/self-evolving-skill/mcporter_adapter.py skill_list '{}'
# 创建新Skill
python3 ~/.openclaw/skills/self-evolving-skill/mcporter_adapter.py skill_create '{"name":"MySkill"}'
# 分析嵌入
python3 ~/.openclaw/skills/self-evolving-skill/mcporter_adapter.py skill_analyze '{"embedding":[0.1,0.2,0.3]}'
The documentation exposes a destructive skill_clear capability that wipes all data and cache, but provides no warning, confirmation guidance, backup advice, or scope limitations. In an agent-tooling context, undocumented destructive operations increase the chance of accidental invocation and irreversible loss of stored skills or state.
The skill documentation is written entirely in Chinese, including headings, comments, and usage guidance, with no indication that other languages are supported or that the locale limitation is intentional and justified. Under the policy, language constraints should be opt-in or clearly documented as region-specific.
The skill advertises operational capabilities such as environment access and local execution flows, but it does not declare any tool scope or permission boundaries in the manifest. This creates a transparency and least-privilege failure: an agent or user may invoke the skill without understanding that it can access local environment state or perform broader actions than expected.
The documentation states that experience is automatically persisted and reloaded, but it does not warn users that local data will be written to disk. In a self-evolving skill context, silent persistence can accumulate sensitive prompts, embeddings, or operational history without informed consent.
The skill exposes create/execute/analyze/stats flows and separately documents automatic saving/loading and storage paths, indicating session persistence across runs. In a self-learning system, persistent session state can retain sensitive inputs, inferred patterns, or prior context, increasing privacy and integrity risk if data is reused unexpectedly or accessed by other local processes.
openclaw skill self-evolving-skill list
# 创建Skill
openclaw skill self-evolving-skill create --name "MySkill"
# 执行
openclaw skill self-evolving-skill execute <id> --success
The README provides commands to start an MCP server and execute the skill, but it omits warnings about local data access, persistent storage, and possible system modifications. This is risky because users may launch a long-running server process or execute commands with side effects under the assumption that the skill is purely analytical.
The module docstring states the adapter is provided in Chinese, and the file consistently uses Chinese-only user-facing strings. This imposes a specific language/locale choice without offering the user an option or documenting that the skill is intended only for a Chinese-speaking context.
The manifest describes a 'meta-cognitive self-learning system' focused on automated skill evolution, predictive coding, and value-driven mechanisms. In this file, the exposed functionality is primarily creating placeholder skills, listing them, loading/saving them from storage, and returning stats or embedding analysis, which is a management adapter rather than automated self-evolution behavior.
The package description is written entirely in Chinese, which imposes a specific language context in a user-facing manifest field without offering any language choice or documenting a justified locale restriction. This can violate language/locale policy when the skill is not clearly limited to a Chinese-only audience or region-specific use case.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The file-level documentation and manifest suggest a substantive self-evolving learning system, yet this code mostly forwards tool calls to an external Python server and, when unavailable, returns simulated placeholder responses. That creates a semantic mismatch between the claimed autonomous evolution behavior and the actual operations present in this file.
The manifest describes a meta-cognitive self-learning and skill-evolution system, but this file also includes infrastructure capabilities to launch an external Python process and communicate with it over HTTP. Those host-level execution and local server management capabilities are not an obvious requirement from the manifest text itself and materially expand what the skill can do.
The code silently spawns a Python subprocess that persists as a local service, increasing attack surface and executing additional code outside the user's immediate visibility. In a skill marketed as self-evolving, this hidden behavior is more sensitive because it can process user context and storage data, and users are not warned that a separate runtime will be launched.
Detected: suspicious.dangerous_exec