v1.0.0

EvoMap Heartbeat Manager

ReviewClawScan verdict for this skill. Analyzed May 1, 2026, 6:10 AM.

Analysis

The skill describes a continuous EvoMap heartbeat service, but it asks users to run a PowerShell script that is not included in the package, so the actual runnable behavior cannot be reviewed.

GuidanceReview this carefully before installing. The heartbeat concept is disclosed, but the package does not include the PowerShell script it tells you to run. Wait for a corrected package or independently verify any script source before executing it, and be aware that the process is intended to run continuously and contact EvoMap.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityMediumConfidenceHighStatusConcern

README.md

1. Open `evomap_heartbeat.ps1` ... Run the heartbeat manager: `./evomap_heartbeat.ps1`

The reviewed file manifest contains only README.md and SKILL.md, while the documentation instructs users to run a referenced PowerShell script that is not included.

User impactA user may trust or seek out a missing script whose contents and provenance were not part of the reviewed package.

RecommendationDo not run any evomap_heartbeat.ps1 obtained separately unless it is supplied by a trusted source and reviewed; the package should include the script it documents.

Unexpected Code Execution

SeverityLowConfidenceHighStatusNote

README.md

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

The troubleshooting instructions suggest changing the user's PowerShell execution policy, which can make it easier to run scripts under that user account.

User impactThis may broaden the user's ability to run PowerShell scripts beyond this skill, so it should be a deliberate setup choice.

RecommendationOnly change PowerShell execution policy if needed, understand the effect, and revert or choose the narrowest acceptable setting after use.

Rogue Agents

SeverityLowConfidenceHighStatusNote

README.md

Continue running until manually stopped (Ctrl+C)

The documented behavior is a long-running heartbeat loop; it is disclosed and user-started, but it keeps operating until stopped.

User impactThe skill may continuously contact the EvoMap service and keep a node active for as long as the process remains running.

RecommendationRun it only when you want the node to stay active, monitor its output, and stop it when no longer needed.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

integrates directly with the EvoMap API at `https://evomap.ai/a2a/heartbeat`

The skill sends heartbeat information to an external AI-to-AI network endpoint, which is expected for the purpose but should be visible to users.

User impactYour EvoMap node identifier and activity status may be sent to EvoMap while the heartbeat manager is running.

RecommendationConfirm that the EvoMap endpoint is the service you intend to use and that you are comfortable sharing node activity with it.