Evolver.Bak

AdvisoryAudited by Static analysis on May 10, 2026.

Overview

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Findings (17)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

The agent may modify code or persistent memory without stopping for human approval.

Why it was flagged

The skill makes immediate automated changes the default, while the safer review mode is optional.

Skill content

If no flags are provided, it assumes fully automated mode (Mad Dog Mode) and executes changes immediately.

Recommendation

Run only in an isolated, git-backed workspace; use --review by default; restrict write access and require explicit approval before applying changes.

ConcernHigh Confidence

ASI10: Rogue Agents

What this means

Once started in loop mode, the evolver can keep running and restarting itself while making further decisions.

Why it was flagged

The implementation supports continuous autonomous operation and detached self-restart in loop mode.

Skill content

while (true) { ... await evolve.run(); ... const child = spawn(process.execPath, [__filename, ...args], spawnOpts); child.unref();

Recommendation

Avoid loop/cron mode unless you have process supervision, clear stop procedures, logging, and a bounded test environment.

ConcernHigh Confidence

ASI06: Memory and Context Poisoning

What this means

Sensitive logs may be incorporated into persistent evolution artifacts, and poisoned history could steer future code or memory changes.

Why it was flagged

Runtime history and memory can contain sensitive or untrusted content, and this skill uses those inputs to guide future evolution.

Skill content

Automatically scans memory and history files for errors and patterns.

Recommendation

Limit scanned paths, exclude secrets/private logs, review generated Gene/Capsule/Event artifacts, and reset persistent state if untrusted content was ingested.

ConcernMedium Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Agent state, identifiers, assets, or task-related signals may be exchanged with an external service if networked features are enabled.

Why it was flagged

The static scan shows a default external hub for A2A/task communication, while index.js starts an A2A heartbeat in loop mode.

Skill content

const HUB_URL = process.env.A2A_HUB_URL || process.env.EVOMAP_HUB_URL || 'https://evomap.ai';

Recommendation

Do not enable A2A/loop networking until you confirm what is sent, set an approved hub URL, and understand identity and data-boundary controls.

ConcernHigh Confidence

ASI09: Human-Agent Trust Exploitation

What this means

Users may underestimate how much authority the skill can exercise by default.

Why it was flagged

This safety claim conflicts with SKILL.md statements that the skill can autonomously write code/update memory and that default mode executes changes immediately.

Skill content

Does this edit code automatically? No. It generates a protocol-bound prompt and assets that guide evolution.

Recommendation

Treat the SKILL.md default behavior as authoritative, and require review/approval until the actual mutation path is independently verified.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

If provided, a broad GitHub token could allow release or repository changes.

Why it was flagged

The token is optional and tied to release publishing, but it can grant account-level authority outside normal local evolution.

Skill content

`GITHUB_TOKEN` (or `GH_TOKEN` / `GITHUB_PAT`) for GitHub Release creation

Recommendation

Use a least-privilege token only for release tasks, never for routine evolution runs.

NoteMedium Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

It may be harder to confirm that this package matches a trusted upstream release.

Why it was flagged

For a self-modifying skill with many code files, unclear provenance and mismatched registry/package versioning increase the need for verification.

Skill content

Source: unknown; Homepage: none

Recommendation

Verify the package origin, compare with the intended upstream repository, and pin a reviewed version before use.

Findings (17)

critical

suspicious.dangerous_exec

Location: index.js:164
Finding: Shell command execution detected (child_process).

critical

suspicious.dangerous_exec

Location: scripts/build_public.js:169
Finding: Shell command execution detected (child_process).

critical

suspicious.dangerous_exec

Location: scripts/generate_history.js:17
Finding: Shell command execution detected (child_process).

critical

suspicious.dangerous_exec

Location: scripts/publish_public.js:13
Finding: Shell command execution detected (child_process).

critical

suspicious.dangerous_exec

Location: scripts/recover_loop.js:19
Finding: Shell command execution detected (child_process).

critical

suspicious.dangerous_exec

Location: scripts/suggest_version.js:27
Finding: Shell command execution detected (child_process).

critical

suspicious.dangerous_exec

Location: src/evolve.js:276
Finding: Shell command execution detected (child_process).

critical

suspicious.dangerous_exec

Location: src/gep/solidify.js:64
Finding: Shell command execution detected (child_process).

critical

suspicious.dangerous_exec

Location: src/ops/health_check.js:20
Finding: Shell command execution detected (child_process).

critical

suspicious.dangerous_exec

Location: src/ops/lifecycle.js:27
Finding: Shell command execution detected (child_process).

critical

suspicious.dangerous_exec

Location: src/ops/self_repair.js:17
Finding: Shell command execution detected (child_process).

critical

suspicious.dangerous_exec

Location: src/ops/skills_monitor.js:96
Finding: Shell command execution detected (child_process).

critical

suspicious.env_credential_access

Location: src/gep/a2aProtocol.js:75
Finding: Environment variable access combined with network send.

critical

suspicious.env_credential_access

Location: src/gep/hubSearch.js:18
Finding: Environment variable access combined with network send.

critical

suspicious.env_credential_access

Location: src/gep/memoryGraphAdapter.js:77
Finding: Environment variable access combined with network send.

critical

suspicious.env_credential_access

Location: src/gep/taskReceiver.js:11
Finding: Environment variable access combined with network send.

critical

suspicious.exposed_secret_literal

Location: test/sanitize.test.js:12
Finding: File appears to expose a hardcoded API secret or token.