InspirAI Evo

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is coherent with its workflow-analysis purpose, but users should notice that it writes local state, keeps cross-project stats, and can guide future file changes with confirmation.

This skill appears safe to install as an instruction-only workflow-analysis helper. Before using it, be aware that it creates or updates .evo-state.json, writes reports under docs/evo-reports, may copy project state into ~/.claude/evo-stats, and can optionally add persistent CLAUDE.md monitoring rules. Review proposed file changes during --continue before accepting them.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

If used carelessly, the skill could make changes to project files or configuration as part of an improvement workflow.

Why it was flagged

The skill can guide the agent to modify project files while processing pending improvements. This is purpose-aligned and includes user confirmation, but it is still workspace-changing authority.

Skill content

3. 逐个展示待处理项：
   - 显示问题详情和建议
   - 分析需要修改的文件
   - 提出具体修改方案
   - 用户确认后执行修改

Recommendation

Use --continue only in the intended project, review the proposed plan, and inspect diffs before committing or relying on changes.

Note

ASI06: Memory and Context Poisoning

What this means

Workflow context and pending-improvement summaries may remain on disk and be reused later, including across projects.

Why it was flagged

The skill persists project workflow state into a global local stats directory for reuse across projects. This is disclosed and relevant to the purpose, but it creates persistent context that may influence later analysis.

Skill content

GLOBAL_DIR="$HOME/.claude/evo-stats"
mkdir -p "$GLOBAL_DIR/projects"

# 更新项目统计
PROJECT_NAME=$(basename $(pwd))
cp .evo-state.json "$GLOBAL_DIR/projects/$PROJECT_NAME.json"

Recommendation

Avoid storing secrets in .evo-state.json, keep it out of version control as suggested, and periodically review or delete ~/.claude/evo-stats if the retained context is no longer wanted.

Note

ASI10: Rogue Agents

What this means

Future agent sessions in the project may automatically track workflow signals and update .evo-state.json if the CLAUDE.md monitoring block is added.

Why it was flagged

The skill describes adding persistent instructions to CLAUDE.md so future sessions automatically detect signals, update state, and prompt the user. This is optional and disclosed, but it changes future agent behavior.

Skill content

将以下内容添加到项目的 CLAUDE.md 以启用自动信号检测。

Recommendation

Only add the CLAUDE.md monitoring rules if you want persistent monitoring, and remove that block if you want to disable the behavior.