Security audit

Harness Evolve

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly transparent about self-inspection, but it grants broad log access, automatic file changes and commits, and an unsafe optional shell notification path.

Install only if you are comfortable with an agent reading recent logs or memory, editing project files, and creating commits. Before use, remove or tightly restrict notify_command, require explicit confirmation for every write/delete/commit, and treat all config_files changes as proposal-only.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:54
Finding: Overly Broad Access to Agent Runtime Logs and Memory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:77
Finding: Ambiguous File Cleanup Can Delete and Commit Legitimate Project Data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:146
Finding: Project-Controlled Notification Template Enables Arbitrary Shell Command Execution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Self-Modification

High

Category: Rogue Agent
Confidence: 99% confidence
Finding: This skill is explicitly designed for self-evolution and architecture optimization of an AI agent system, including reading core configuration, generating proposals, directly modifying some project files, and committing changes. Self-modification is inherently high risk because it can alter future agent behavior, weaken safeguards, and create persistence mechanisms, especially when combined with ambiguous boundaries and optional command execution.
Content: Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.
md
description: > AI Agent 自进化引擎——消费研究日志 → 系统自检 → 架构优化（分级执行/提案）→ 写入当日进化摘要。适用于任何 AI Agent 系统：OpenClaw、Claude Code agent、AutoGPT、LangGraph 或自研框架。触发词：自进化、self-evolve、架构优化、agent升级、harness进化、系统自检。 --- # Harness Evolve — AI Agent 自进化引擎

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The A-level 'direct execution' section claims only safe_files may be modified, but its examples explicitly include modifying config_files. Because config_files are defined as core behavior/rules files, this contradiction can authorize unauthorized runtime-affecting self-modification under the guise of low-risk edits.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The 'config_files 绝不自主修改' rule directly conflicts with earlier instructions that permit direct edits to config_files. In an autonomous agent context, such contradictions are dangerous because the model may follow the more permissive branch, resulting in unintended or unauthorized self-modification of governing prompts or rules.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The listed triggers include generic phrases such as "架构优化", "agent升级", and "系统自检", alongside a broad applicability claim to "任何 AI Agent 系统". In a markdown skill description, these terms are not narrowly scoped to a specific command context and could cause unintended invocation during normal planning or discussion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill authorizes file modification, git commits, and optional command execution, yet it does not present a clear user-facing warning or confirmation gate before performing system-impacting actions. In an agent environment, this increases the risk of surprising destructive or policy-violating behavior, especially when triggered by broad phrases.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill allows an externally configured notify_command template to be executed as a shell command, with runtime substitution of {message}. Even though framed as optional notification behavior, this introduces arbitrary command execution capability unrelated to core summarization and can be abused through malicious configuration or unsafe quoting/templating.
Content: No source excerpt is available for this finding.