ClawHub
Back to skill

Security audit

Protea Self Evolving Life Agent

Security checks across malware telemetry and agentic risk

Overview

This skill is openly a self-evolving agent, but it asks users to run an unpinned remote installer and leaves major autonomy, credential, and persistence boundaries undefined.

Treat this as an experimental autonomous coding system, not a lightweight skill. Before installing, inspect and pin the upstream repository and setup script, run it only in a disposable VM or container, use restricted low-quota API keys, and avoid enabling Telegram or long-running self-evolution until you understand its controls and cleanup path.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The quick-start instructs users to execute a remote shell script directly from the network without reviewing or pinning its contents first. This creates a supply-chain and arbitrary code execution risk, especially because the script is described as setting up a complex self-modifying agent that can alter the local system.

Self-Modification

High
Category
Rogue Agent
Content
description: >
  Self-evolving artificial life agent. Three-ring architecture: Ring 0 (Sentinel) supervises,
  Ring 1 (Intelligence) drives LLM-powered evolution, Ring 2 (Evolvable Code) is the living program
  that self-restructures, self-reproduces, and self-evolves. Supports Anthropic, OpenAI, DeepSeek,
  and Qwen as LLM providers. Includes fitness scoring, gene pool inheritance, tiered memory,
  skill crystallization, Telegram bot, and web dashboard.
---
Confidence
93% confidence
Finding
self-evolve

External Script Fetching

Low
Category
Supply Chain
Content
## Quick Start

```bash
curl -sSL https://raw.githubusercontent.com/EdisonChenAI/protea/main/setup.sh | bash
cd protea && .venv/bin/python run.py
```
Confidence
99% confidence
Finding
curl -sSL https://raw.githubusercontent.com/EdisonChenAI/protea/main/setup.sh | bash

Chaining Abuse

High
Category
Tool Misuse
Content
## Quick Start

```bash
curl -sSL https://raw.githubusercontent.com/EdisonChenAI/protea/main/setup.sh | bash
cd protea && .venv/bin/python run.py
```
Confidence
99% confidence
Finding
| bash

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.