Auto Evolution (Hybrid Mode)

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:51 AM UTC
• Version: 2.0.0

Overview

This skill is a disclosed autonomous agent workflow, but it needs Review because it can drive repeated sub-agent execution with weak boundaries and unsafe task-state handling.

Install only in an isolated workspace with limited agent tools and no unnecessary credentials. Do not enable cron/heartbeat unattended until task files are trusted, filename/path handling is fixed, review and audit parsing fail closed, iteration limits are enforced, and human approval is required for sensitive file, command, network, or skill-modifying actions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/heartbeat-coordinator.js:113
• Finding: Untrusted Task Content Can Hijack Privileged Agent Prompts<![CDATA[ ## Vulnerability Details **File Location**: `scripts/heartbeat-coordinator.js:113-162`, with additional injection sinks at `scripts/heartbeat-coordinator.js:229-235`, `scripts/heartbeat-coordinator.js:310`, and `scripts/start-reviewer.js:47` **Vulnerability Type**: Prompt injection across agent trust boundaries **Risk Level**: High ### Vulnerable Code ```js function buildReviewPrompt(task) { const iteration = (task.current_iteration || 0) + 1; const subtasks = task.context?.subtasks || []; const lastResult = task.result || {}; const completedStep = lastResult.subtask_completed || 0; const nextStep = completedStep + 1; let prompt = `You are a Reviewer for the auto-evolution system. ## Task - **ID:** ${task.task_id} - **Goal:** ${task.goal} - **Iteration:** ${iteration} / ${task.max_iterations} - **Progress:** ${completedStep} / ${subtasks.length} subtasks ## Subtasks ${subtasks.map((s, i) => `${i + 1}. ${s}`).join('\n')} ## Previous Result ${lastResult.summary || '(First iteration)'} `; if (completedStep >= subtasks.length) { prompt += ` ## All subtasks completed — finalize Set verdict to "complete" and summarize the outcome. `; } else { prompt += ` ## Your Job 1. Review previous result (if any) 2. Decide: approve / revise / reject 3. Write specific instructions for subtask ${nextStep} 4. Define acceptance criteria ## Output (strict JSON) \`\`\`json { "verdict": "approve", "feedback": "Review comments", "next_instructions": { "summary": "Iteration ${iteration}: Step ${nextStep}", "current_step": ${nextStep}, "total_steps": ${subtasks.length}, "step": { "step": ${nextStep}, "action": "${subtasks[nextStep - 1] || ''}", "detail": "Implementation details..." }, "acceptance_criteria": ["Criterion 1", "Criterion 2"] } } \`\`\` Output only JSON. `; } return prompt; } ``` Additional execution-stage sinks include: ```js return `You are an Executor for the auto-evolution s ...[truncated 2797 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat every task field and every model response as untrusted data. 2. Pass task data through structured agent or tool arguments instead of embedding it in free-form instructions where supported. 3. Place untrusted content inside explicit delimiters and add a higher-priority instruction stating that content inside those delimiters is data and must never be interpreted as agent directives. 4. Validate task fields against a strict schema, including types, lengths, supported characters, and expected object structure. 5. Enforce file and command allowlists for Executor agents rather than relying on prompt text. 6. Run spawned agents with least privilege in an isolated workspace, without unnecessary credentials or access to unrelated files. 7. Require human authorization for sensitive operations, including external network access, credential access, and modifications outside the task-specific directory. 8. Validate reviewer-generated `next_instructions` against the original task scope before sending them to an Executor. 9. Ensure the Auditor independently verifies actual artifacts and test results rather than trusting task-controlled summaries. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/heartbeat-coordinator.js:453
• Finding: Task Filename Traversal Allows Arbitrary Writable JSON Files to Be Overwritten<![CDATA[ ## Vulnerability Details **File Location**: `scripts/heartbeat-coordinator.js:453-468`, with overwrite sinks at lines `171-209`, `260-296`, and `342-382` **Vulnerability Type**: Path traversal and unrestricted file overwrite **Risk Level**: High ### Vulnerable Code ```js // CLI sub-commands const [,, cmd, taskFile, resultFile] = process.argv; if (cmd === 'apply-review' && taskFile && resultFile) { const task = JSON.parse(fs.readFileSync(path.join(TASKS_DIR, taskFile), 'utf8')); task.file = taskFile; applyReview(task, fs.readFileSync(resultFile, 'utf8')); } else if (cmd === 'apply-exec' && taskFile && resultFile) { const task = JSON.parse(fs.readFileSync(path.join(TASKS_DIR, taskFile), 'utf8')); task.file = taskFile; applyExecution(task, fs.readFileSync(resultFile, 'utf8')); } else if (cmd === 'apply-audit' && taskFile && resultFile) { const task = JSON.parse(fs.readFileSync(path.join(TASKS_DIR, taskFile), 'utf8')); task.file = taskFile; applyAudit(task, fs.readFileSync(resultFile, 'utf8')); ``` The attacker-controlled path is later reused for writes: ```js function applyReview(task, reviewResult) { const filePath = path.join(TASKS_DIR, task.file); const data = JSON.parse(fs.readFileSync(filePath, 'utf8')); const now = new Date().toISOString(); // State mutation omitted fs.writeFileSync(filePath, JSON.stringify(data, null, 2)); console.log(`✅ Task ${task.task_id} reviewed: ${review.verdict}`); return review.verdict; } ``` Equivalent read-modify-write behavior is present in `applyExecution` and `applyAudit`. ### Technical Analysis The `taskFile` command-line argument is joined to `TASKS_DIR` without validating that it is a simple task filename. In Node.js, `path.join()` normalizes traversal sequences but does not enforce containment. A value such as `../../configuration.json` can therefore resolve outside the tasks directory. The selected file must contain valid JSON because the script parses it before mutatio ...[truncated 1892 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Accept only task basenames matching a strict pattern such as: ```js if (!/^task-\d+\.json$/.test(taskFile)) { throw new Error('Invalid task filename'); } ``` 2. Canonicalize and enforce directory containment: ```js const tasksRoot = fs.realpathSync(TASKS_DIR); const candidate = path.resolve(tasksRoot, taskFile); if (!candidate.startsWith(tasksRoot + path.sep)) { throw new Error('Task path escapes tasks directory'); } ``` 3. Reject symbolic links or compare `fs.realpathSync(candidate)` against the canonical tasks root. 4. Restrict result files to a dedicated results directory using the same canonical containment checks, or receive model results through standard input. 5. Verify that the task file's basename and internal `task_id` correspond. 6. Validate task JSON against `config/task-schema.json` before mutation. 7. Use atomic writes through a securely created temporary file in the same directory, followed by `renameSync()`. 8. Run the coordinator under an account that cannot write security-sensitive configuration outside the evolution workspace. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/heartbeat-coordinator.js:174
• Finding: Malformed Reviewer and Auditor Responses Are Accepted as Successful<![CDATA[ ## Vulnerability Details **File Location**: `scripts/heartbeat-coordinator.js:174-183` and `scripts/heartbeat-coordinator.js:345-354` **Vulnerability Type**: Fail-open validation of security and quality gates **Risk Level**: High ### Vulnerable Code Reviewer parsing defaults to approval: ```js let review; try { const jsonMatch = reviewResult.match(/```json\s*([\s\S]*?)\s*```/) || reviewResult.match(/\{[\s\S]*"verdict"[\s\S]*\}/); const jsonStr = jsonMatch ? (jsonMatch[1] || jsonMatch[0]) : reviewResult; review = JSON.parse(jsonStr); } catch (err) { console.error('⚠️ Parse review failed:', err.message); review = { verdict: 'approve', feedback: reviewResult, next_instructions: null }; } ``` Auditor parsing defaults to pass: ```js let audit; try { const jsonMatch = auditResult.match(/```json\s*([\s\S]*?)\s*```/) || auditResult.match(/\{[\s\S]*"verdict"[\s\S]*\}/); const jsonStr = jsonMatch ? (jsonMatch[1] || jsonMatch[0]) : auditResult; audit = JSON.parse(jsonStr); } catch (err) { console.error('⚠️ Parse audit failed:', err.message); audit = { verdict: 'pass', feedback: auditResult }; } ``` The fabricated audit verdict advances the workflow: ```js if (audit.verdict === 'pass') { if (allDone) { data.status = 'completed'; } else { data.status = 'pending'; // Next subtask } } else { // Fail — retry data.status = 'pending'; data.current_iteration = (data.current_iteration || 0) + 1; } ``` ### Technical Analysis Reviewer and Auditor responses are intended to act as quality gates. If JSON parsing fails, however, the implementation fabricates a successful verdict instead of rejecting the response. This is a fail-open design. Any malformed output—including accidental truncation, provider errors, plain-text failure messages, or intentionally invalid JSON—becomes an approval or pass. The code also does not validate successfully parsed objects against a schema or restrict `ve ...[truncated 1567 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Fail closed whenever parsing fails. Preserve the current state and record a parse error rather than fabricating approval: ```js catch (err) { throw new Error(`Invalid audit response: ${err.message}`); } ``` 2. Validate parsed responses against strict JSON schemas. 3. Restrict reviewer verdicts to explicitly supported values such as `approve`, `revise`, `reject`, and `complete`. 4. Restrict auditor verdicts to `pass` or `fail`. 5. Require all fields needed for a transition, including valid step numbers, feedback, criteria results, and instructions. 6. Reject an approval if `next_instructions` is absent for an unfinished task. 7. Store raw model output separately for diagnostics without treating it as an authoritative decision. 8. Retry transient model failures with a bounded retry count, then set the task to `needs_manual`. 9. Require independent artifact or test verification before allowing the final transition to `completed`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/heartbeat-coordinator.js:116
• Finding: Configured Maximum Iteration Limit Is Not Enforced<![CDATA[ ## Vulnerability Details **File Location**: `scripts/heartbeat-coordinator.js:116-121`, `scripts/heartbeat-coordinator.js:185-191`, and `scripts/heartbeat-coordinator.js:360-370` **Vulnerability Type**: Unbounded autonomous workflow execution **Risk Level**: Medium ### Vulnerable Code The limit is displayed only as prompt text: ```js function buildReviewPrompt(task) { const iteration = (task.current_iteration || 0) + 1; let prompt = `You are a Reviewer for the auto-evolution system. ## Task - **ID:** ${task.task_id} - **Goal:** ${task.goal} - **Iteration:** ${iteration} / ${task.max_iterations} ``` Iterations are incremented without checking the configured maximum: ```js if (review.verdict === 'complete') { data.status = 'completed'; data.review = { verdict: 'complete', reviewed_at: now, feedback: review.feedback }; } else { data.status = 'reviewed'; data.current_iteration = (data.current_iteration || 0) + 1; data.review = { verdict: review.verdict || 'approve', reviewed_at: now, feedback: review.feedback || '', next_instructions: review.next_instructions || null }; } ``` Failed audits also increment the counter and return the task to the pending state: ```js if (audit.verdict === 'pass') { if (allDone) { data.status = 'completed'; } else { data.status = 'pending'; // Next subtask } } else { // Fail — retry data.status = 'pending'; data.current_iteration = (data.current_iteration || 0) + 1; } ``` ### Technical Analysis `max_iterations` is part of the task format and is presented to the Reviewer, but no scheduling or state-transition function compares `current_iteration` with it. The coordinator continues selecting any task whose status is `pending`, `reviewed`, or `executing`, regardless of how many iterations have occurred. The limit is therefore advisory prompt text rather than an enforced control. Repeated audit failures, non-progressing reviews, or inconsistent subtask completion value ...[truncated 1166 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Enforce the limit before task selection and before every state transition: ```js if ((task.current_iteration || 0) >= task.max_iterations) { task.status = 'needs_manual'; // Persist terminal state and stop scheduling. } ``` 2. Add terminal states such as `failed` or `needs_manual` to the task schema. 3. Reject missing, non-integer, negative, or unreasonably large iteration limits. 4. Define whether a complete review-execute-audit cycle counts as one iteration and increment the counter in exactly one place. 5. Apply bounded retry limits separately to parsing failures, audit failures, and execution failures. 6. Require explicit human authorization to resume a task after the limit is reached. 7. Add per-task model-budget, elapsed-time, and tool-invocation limits. 8. Ensure `selectNextTask()` excludes tasks that have reached their retry or iteration ceilings. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared description presents a full multi-agent auto-evolution/orchestration system with autonomous execution, four agent roles, iterative review/execute/audit cycles, and quality assurance. The supplied code chunk only implements a task creation utility. It interactively gathers task details, assesses complexity, selects manual versus automatic subtask mode, optionally captures manual subtasks, stores reviewer metadata for later use, and saves a JSON task file. While the script conceptually supports the described system by preparing task inputs and distinguishing manual versus auto subtask workflows, it does not itself implement the core declared behavior. Therefore the description materially overstates what this code chunk actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The description overstates the implemented functionality. The code is a coordinator/task-state manager for a review/execute/audit workflow stored in JSON files. It acquires a lock, scans tasks, chooses the next phase, prints a structured prompt for an external agent to handle, and provides CLI commands to apply returned results. That generally aligns with an orchestration concept, but several central claims are not implemented in this chunk: there is no actual spawning or running of sub-agents, no distinct Coordinator agent behavior beyond this script, no automatic generation of subtasks by the Reviewer, no explicit hybrid manual-vs-automatic subtask mode, and no result packaging system. The primary behavior is narrower: single-step prompt generation and state transition management for pre-defined subtasks. Therefore the declared description does not accurately represent what this code chunk actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a full multi-agent orchestration system with four roles, subtask generation, review-execute-audit loops, and autonomous task execution with quality assurance. The supplied code does not implement or directly orchestrate those capabilities. Instead, it is a maintenance utility focused on operational monitoring of task files in a workspace directory. It performs filesystem-based housekeeping: deleting stale/corrupt lock files, detecting tasks stuck in certain statuses, rewriting task JSON to reset them to pending, checking for consecutive failures, and printing a report. While this could be a supporting component within a larger evolution system, the code chunk itself has a materially different primary purpose and includes undeclared capabilities related to filesystem monitoring and automatic recovery. Therefore the description does not accurately represent what this specific code chunk actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description presents a complex autonomous multi-agent system for evolving tasks through coordinated review, execution, auditing, and packaging. The supplied code does not implement any of that orchestration behavior. It is a narrow maintenance utility that reads task files from disk, filters for completed tasks, marks them as packaged, archives them, and removes the originals. While the description mentions auto-packaging results, that is only one small supporting aspect; the actual code chunk's primary and only behavior is packaging/archiving completed tasks. This is a material description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description presents a complete autonomous multi-agent workflow system with Coordinator, Reviewer, Executor, and Auditor roles, including automatic iteration, quality assurance gates, and result packaging. The supplied code chunk implements only a narrow subset: a Reviewer starter utility. Its primary behavior is file I/O around a task definition, validation that the task is in auto mode, construction of a reviewer prompt, and printing pseudocode/manual next steps. It does not actually invoke sessions_spawn, does not run any agents, and does not perform execution, auditing, loop control, or packaging. This is a material description-behavior mismatch rather than a mere partial implementation detail.

Ae1

High

• Category: analysis-evasion

Content

node scripts/start-reviewer.js <task-id>

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| `scripts/heartbeat-coordinator.js` | Coordinator: scan tasks → spawn Reviewer/Executor/Auditor |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| `scripts/heartbeat-coordinator.js` | Coordinator: scan tasks → spawn Reviewer/Executor/Auditor |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| `scripts/heartbeat-coordinator.js` | Coordinator: scan tasks → spawn Reviewer/Executor/Auditor |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| `scripts/heartbeat-coordinator.js` | Coordinator: scan tasks → spawn Reviewer/Executor/Auditor |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| `scripts/heartbeat-coordinator.js` | Coordinator: scan tasks → spawn Reviewer/Executor/Auditor |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| `scripts/monitor.js` | Monitor: detect stuck tasks, clean orphaned locks |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| `scripts/monitor.js` | Monitor: detect stuck tasks, clean orphaned locks |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

`;
  }

  return prompt;
}

function applyReview(task, reviewResult) {

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly markets autonomous agent behavior ('build things while you sleep') and describes spawned sub-agents performing review, execution, and audit, but it does not warn that these agents may modify files, create artifacts, or otherwise take actions without real-time user oversight. In an agent-skill context, that omission can cause users to enable powerful unattended automation without understanding the operational and security consequences, increasing the chance of unsafe deployment or unintended workspace changes.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The cron setup instructs users to schedule the coordinator every 5 minutes in an isolated session, causing recurring autonomous processing of tasks, but it provides no safety notice about unattended execution, repeated retries, or cumulative changes over time. This is especially risky in this skill because the coordinator can continuously spawn sub-agents that execute subtasks, so a misconfigured task or unsafe instruction could be repeatedly acted on without immediate human review.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill describes and instructs use of code-executing scripts and environment-variable-based configuration, but it declares no explicit tool scope or permissions boundary. In an agent ecosystem, that omission can cause the skill to be invoked with broader capabilities than intended, increasing the chance of unauthorized filesystem, process, or environment access.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill uses very broad activation language such as 'use when user wants autonomous task execution,' which can cause the orchestrator to match many ordinary requests and trigger an overly powerful meta-skill unnecessarily. Overbroad matching increases the chance of unintended code/script execution, task spawning, or workspace mutation in contexts that did not require such automation.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The skill description and operational guidance in this file are written only in Chinese, with no language selection, fallback, or explicit opt-in. In an agent-orchestration skill that can drive autonomous multi-step execution, this creates a real safety and transparency problem because users or downstream reviewers may not understand what the skill will do, increasing the chance of uninformed use or misconfiguration.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file includes a Chinese-only description and the interactive CLI prompts throughout the script are presented in Chinese, which imposes a specific language on users. The policy allows locale constraints only when the user is given a choice or the restriction is clearly documented and justified, neither of which is present here.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file's natural-language strings and embedded prompt are written entirely in Chinese, including the role description and operational instructions. This imposes a specific language/locale on users without any visible opt-in or alternative, which matches the language-policy violation criteria.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The package description is written entirely in Chinese, which can indicate a language-specific skill description without offering any language or locale choice. Under the policy, language constraints should be opt-in or clearly justified; no such justification appears in this manifest.

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: The file banner says 'Auto Revolution Task Creator' while the manifest identifies the skill as 'auto-evolution'. Because this script is clearly part of that skill and implements task creation for it, the documentation appears to refer to a different named system, which is an active mismatch in stated intent rather than merely missing detail.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The file's natural-language interface is consistently Chinese in comments and user-facing console output, including operational messages like packaging, skipping, and failure notices. This can violate a language/locale policy when the skill does not offer any language choice or document that it is intentionally Chinese-only.

Static analysis

No suspicious patterns detected.