Security audit

Auto Evolution (Hybrid Mode)

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed autonomous agent workflow, but it needs Review because it can drive repeated sub-agent execution with weak boundaries and unsafe task-state handling.

Install only in an isolated workspace with limited agent tools and no unnecessary credentials. Do not enable cron/heartbeat unattended until task files are trusted, filename/path handling is fixed, review and audit parsing fail closed, iteration limits are enforced, and human approval is required for sensitive file, command, network, or skill-modifying actions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: scripts/heartbeat-coordinator.js:113
Finding: Untrusted Task Content Can Hijack Privileged Agent Prompts
Content: View full analysis
`${i + 1}. ${s}`).join('\n')} ## Previous Result ${lastResult.summary || '(First iteration)'} `; if (completedStep >= subtasks.length) { prompt += ` ## All subtasks completed — finalize Set verdict to "complete" and summarize the outcome. `; } else { prompt += ` ## Your Job 1. Review previous result (if any) 2. Decide: approve / revise / reject 3. Write specific instructions for subtask ${nextStep} 4. Define acceptance criteria ## Output (strict JSON) \`\`\`json { "verdict": "approve", "feedback": "Review comments", "next_instructions": { "summary": "Iteration ${iteration}: Step ${nextStep}", "current_step": ${nextStep}, "total_steps": ${subtasks.length}, "step": { "step": ${nextStep}, "action": "${subtasks[nextStep - 1] || ''}", "detail": "Implementation details..." }, "acceptance_criteria": ["Criterion 1", "Criterion 2"] } } \`\`\` Output only JSON. `; } return prompt; } ``` Additional execution-stage sinks include: ```js return `You are an Executor for the auto-evolution s ...[truncated 2797 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/heartbeat-coordinator.js:453
Finding: Task Filename Traversal Allows Arbitrary Writable JSON Files to Be Overwritten
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/heartbeat-coordinator.js:174
Finding: Malformed Reviewer and Auditor Responses Are Accepted as Successful
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/heartbeat-coordinator.js:116
Finding: Configured Maximum Iteration Limit Is Not Enforced
Content: View full analysis
Remediation: View remediation
= task.max_iterations) { task.status = 'needs_manual'; // Persist terminal state and stop scheduling. } ``` 2. Add terminal states such as `failed` or `needs_manual` to the task schema. 3. Reject missing, non-integer, negative, or unreasonably large iteration limits. 4. Define whether a complete review-execute-audit cycle counts as one iteration and increment the counter in exactly one place. 5. Apply bounded retry limits separately to parsing failures, audit failures, and execution failures. 6. Require explicit human authorization to resume a task after the limit is reached. 7. Add per-task model-budget, elapsed-time, and tool-invocation limits. 8. Ensure `selectNextTask()` excludes tasks that have reached their retry or iteration ceilings. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description presents a full multi-agent auto-evolution/orchestration system with autonomous execution, four agent roles, iterative review/execute/audit cycles, and quality assurance. The supplied code chunk only implements a task creation utility. It interactively gathers task details, assesses complexity, selects manual versus automatic subtask mode, optionally captures manual subtasks, stores reviewer metadata for later use, and saves a JSON task file. While the script conceptually supports the described system by preparing task inputs and distinguishing manual versus auto subtask workflows, it does not itself implement the core declared behavior. Therefore the description materially overstates what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The description overstates the implemented functionality. The code is a coordinator/task-state manager for a review/execute/audit workflow stored in JSON files. It acquires a lock, scans tasks, chooses the next phase, prints a structured prompt for an external agent to handle, and provides CLI commands to apply returned results. That generally aligns with an orchestration concept, but several central claims are not implemented in this chunk: there is no actual spawning or running of sub-agents, no distinct Coordinator agent behavior beyond this script, no automatic generation of subtasks by the Reviewer, no explicit hybrid manual-vs-automatic subtask mode, and no result packaging system. The primary behavior is narrower: single-step prompt generation and state transition management for pre-defined subtasks. Therefore the declared description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a full multi-agent orchestration system with four roles, subtask generation, review-execute-audit loops, and autonomous task execution with quality assurance. The supplied code does not implement or directly orchestrate those capabilities. Instead, it is a maintenance utility focused on operational monitoring of task files in a workspace directory. It performs filesystem-based housekeeping: deleting stale/corrupt lock files, detecting tasks stuck in certain statuses, rewriting task JSON to reset them to pending, checking for consecutive failures, and printing a report. While this could be a supporting component within a larger evolution system, the code chunk itself has a materially different primary purpose and includes undeclared capabilities related to filesystem monitoring and automatic recovery. Therefore the description does not accurately represent what this specific code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a complex autonomous multi-agent system for evolving tasks through coordinated review, execution, auditing, and packaging. The supplied code does not implement any of that orchestration behavior. It is a narrow maintenance utility that reads task files from disk, filters for completed tasks, marks them as packaged, archives them, and removes the originals. While the description mentions auto-packaging results, that is only one small supporting aspect; the actual code chunk's primary and only behavior is packaging/archiving completed tasks. This is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a complete autonomous multi-agent workflow system with Coordinator, Reviewer, Executor, and Auditor roles, including automatic iteration, quality assurance gates, and result packaging. The supplied code chunk implements only a narrow subset: a Reviewer starter utility. Its primary behavior is file I/O around a task definition, validation that the task is in auto mode, construction of a reviewer prompt, and printing pseudocode/manual next steps. It does not actually invoke sessions_spawn, does not run any agents, and does not perform execution, auditing, loop control, or packaging. This is a material description-behavior mismatch rather than a mere partial implementation detail.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
md
node scripts/start-reviewer.js <task-id>

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
| `scripts/heartbeat-coordinator.js` | Coordinator: scan tasks → spawn Reviewer/Executor/Auditor |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.
md
| `scripts/heartbeat-coordinator.js` | Coordinator: scan tasks → spawn Reviewer/Executor/Auditor |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.
md
| `scripts/heartbeat-coordinator.js` | Coordinator: scan tasks → spawn Reviewer/Executor/Auditor |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.
md
| `scripts/heartbeat-coordinator.js` | Coordinator: scan tasks → spawn Reviewer/Executor/Auditor |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 221)May include surrounding context.
md
| `scripts/heartbeat-coordinator.js` | Coordinator: scan tasks → spawn Reviewer/Executor/Auditor |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
md
| `scripts/monitor.js` | Monitor: detect stuck tasks, clean orphaned locks |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.
md
| `scripts/monitor.js` | Monitor: detect stuck tasks, clean orphaned locks |

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · scripts/heartbeat-coordinator.js (reported line 166)May include surrounding context.
js
`; } return prompt; } function applyReview(task, reviewResult) {

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README explicitly markets autonomous agent behavior ('build things while you sleep') and describes spawned sub-agents performing review, execution, and audit, but it does not warn that these agents may modify files, create artifacts, or otherwise take actions without real-time user oversight. In an agent-skill context, that omission can cause users to enable powerful unattended automation without understanding the operational and security consequences, increasing the chance of unsafe deployment or unintended workspace changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The cron setup instructs users to schedule the coordinator every 5 minutes in an isolated session, causing recurring autonomous processing of tasks, but it provides no safety notice about unattended execution, repeated retries, or cumulative changes over time. This is especially risky in this skill because the coordinator can continuously spawn sub-agents that execute subtasks, so a misconfigured task or unsafe instruction could be repeatedly acted on without immediate human review.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill describes and instructs use of code-executing scripts and environment-variable-based configuration, but it declares no explicit tool scope or permissions boundary. In an agent ecosystem, that omission can cause the skill to be invoked with broader capabilities than intended, increasing the chance of unauthorized filesystem, process, or environment access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill uses very broad activation language such as 'use when user wants autonomous task execution,' which can cause the orchestrator to match many ordinary requests and trigger an overly powerful meta-skill unnecessarily. Overbroad matching increases the chance of unintended code/script execution, task spawning, or workspace mutation in contexts that did not require such automation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description and operational guidance in this file are written only in Chinese, with no language selection, fallback, or explicit opt-in. In an agent-orchestration skill that can drive autonomous multi-step execution, this creates a real safety and transparency problem because users or downstream reviewers may not understand what the skill will do, increasing the chance of uninformed use or misconfiguration.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file includes a Chinese-only description and the interactive CLI prompts throughout the script are presented in Chinese, which imposes a specific language on users. The policy allows locale constraints only when the user is given a choice or the restriction is clearly documented and justified, neither of which is present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file's natural-language strings and embedded prompt are written entirely in Chinese, including the role description and operational instructions. This imposes a specific language/locale on users without any visible opt-in or alternative, which matches the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The package description is written entirely in Chinese, which can indicate a language-specific skill description without offering any language or locale choice. Under the policy, language constraints should be opt-in or clearly justified; no such justification appears in this manifest.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file banner says 'Auto Revolution Task Creator' while the manifest identifies the skill as 'auto-evolution'. Because this script is clearly part of that skill and implements task creation for it, the documentation appears to refer to a different named system, which is an active mismatch in stated intent rather than merely missing detail.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file's natural-language interface is consistently Chinese in comments and user-facing console output, including operational messages like packaging, skipping, and failure notices. This can violate a language/locale policy when the skill does not offer any language choice or document that it is intentionally Chinese-only.
Content: No source excerpt is available for this finding.