Evolution Toolkit

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:49 AM UTC
• Version: 1.0.0

Overview

The toolkit mostly matches its stated self-improvement purpose, but it can silently read and persist sensitive OpenClaw workspace memory and sends optimizer inputs to Gemini without a clear confirmation step.

Install only in a workspace where it is acceptable to analyze and store agent memory, identity/guidance files, task context, and personal reasoning notes. Set `EVOLUTION_TOOLKIT_WORKSPACE` explicitly before running scripts, review generated files under `memory/`, avoid using shared or synced directories for sensitive imprints/reports, and use the Gemini optimizer only when playbooks and test cases are safe to send to Google. Prefer a pinned installer version instead of the README's unpinned `npx` command.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

• Location: README.md:16

Finding

Unpinned Package Execution in the Documented Installation Command

Content

View full analysis

Remediation

View remediation

install ergopitrez/evolution-toolkit ``` 2. Publish and verify a cryptographic integrity value or signed release before execution. 3. Prefer a lockfile-backed installation workflow where practical. 4. Instruct users to inspect the resolved package version before running it. 5. Avoid automatically accepting future versions merely because they share the same package name. 6. Run the installer in a restricted container or sandbox without production credentials or sensitive workspace mounts. 7. Document the trusted registry and package publisher identity. 8. Establish a release-review process and update the pinned version only after auditing the new release. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/contradiction-scanner.js:19

Finding

Implicit Access to Sensitive Agent Workspace Files When Workspace Configuration Is Missing

Content

View full analysis

path.join(WORKSPACE, f)); ``` Those files are read during scanning: ```js GUIDANCE_FILES.forEach(filePath => { const content = readFile(filePath); if (!content) { if (VERBOSE) console.log(c.gray(` ⊘ ${path.relative(WORKSPACE, filePath)} (not found)`)); return; } ``` The session-coherence analyzer reads all matching daily memory logs: ```js function readDailyFiles(maxDays = 30) { const files = fs.readdirSync(MEMORY_DIR) .filter(f => f.match(/^\d{4}-\d{2}-\d{2}\.md$/)) .sort() .slice(-maxDays); return files.map(f => ({ date: f.replace('.md', ''), path: path.join(MEMORY_DIR, f), content: fs.readFileSync(path.join(MEMORY_DIR, f), 'utf8') })); } ``` The session-imprint script also imports task context from `CURRENT.md`: ```js let currentContext = ''; if (fs.existsSync(CURRENT_MD)) { const lines = fs.readFileSync(CURRENT_MD, 'utf8').split('\n').slice(0, 20); currentContext = lines.join('\n'); } ``` ### Technical Analysis The docum ...[truncated 2458 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/skill-optimizer.js:139

Finding

Gemini API Key Included in the Request URL

Content

View full analysis

{ const body = JSON.stringify({ contents: [{ parts: [{ text: prompt }] }], generationConfig: { temperature: 0.3, maxOutputTokens: 2048 } }); const options = { hostname: 'generativelanguage.googleapis.com', path: `/v1beta/models/${model}:generateContent?key=${apiKey}`, method: 'POST', headers: { 'Content-Type': 'application/json' } }; const req = https.request(options, (res) => { let data = ''; res.on('data', (chunk) => data += chunk); res.on('end', () => { try { const json = JSON.parse(data); const text = json.candidates?.[0]?.content?.parts?.[0]?.text; if (!text) { reject(new Error(`No text in response: ${data.slice(0, 200)}`)); return; } resolve(text); } catch (err) { reject(new Error(`Parse error: ${err.message}`)); } }); }); ``` ### Technical Analysis The Gemini API key is interpolated into the HTTP request path as the `key` query parameter. TLS protects the URL while it is transmitted to the intended HTTPS endpoint, but URLs are commonly handled by infrastructure components that may retain request paths, including: - Debugging and instrumentation layers. - Forward proxies. - Application performance monitoring tools. - HTTP request tracing. - Exception and diagnostic logs. A credential in a query string is therefore more exposed to incidental logging than a credential placed in a dedicated authentication header. The reviewed script does not directly print the request path, so exploitation depends on surrounding infrastructure recordi ...[truncated 1361 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (27)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

`scripts/session-imprint.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

`scripts/session-imprint.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

`scripts/cognitive-fingerprint.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

`scripts/cognitive-fingerprint.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

`scripts/contradiction-scanner.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

`scripts/contradiction-scanner.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

`scripts/predict.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

`scripts/predict.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

`scripts/skill-optimizer.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md

`scripts/skill-optimizer.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

`scripts/skill-optimizer.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

`scripts/socratic-mode.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

`scripts/socratic-mode.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

`scripts/session-coherence.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

`scripts/session-coherence.js`

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/contradiction-scanner.js (reported line 108)May include surrounding context.

js

}
    }
  });
  return directives;
}

function extractFilePaths(content, source) {

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to execute npx clawhub install ergopitrez/evolution-toolkit without pinning a specific version or commit. This introduces supply-chain risk because the command may fetch and run whatever package/version is current at install time, allowing compromised upstream releases or dependency confusion-style issues to affect operators installing the toolkit.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The phase-detection cues are broad everyday phrases like 'I think', 'Should I', and 'Build', so the protocol can activate or shift behavior based on normal conversation rather than explicit user intent. In a default-engagement protocol, this can silently change the assistant from answering directly to steering with Socratic questioning or vice versa, creating unintended behavior and reducing user control.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script’s header and usage text describe it as a text analysis tool, but the implementation later auto-saves fingerprint results to a persistent file by default. For a tool analyzing potentially sensitive personal writing, undisclosed persistence creates a privacy and data-retention risk because users may expose behavioral or cognitive-profile data without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code automatically persists a generated cognitive fingerprint for single-file runs unless --no-save is supplied, but the usage/help output does not prominently warn about this behavior. Because cognitive fingerprints are derived from user text and framed as tracking drift and tendencies, silent default storage can accumulate sensitive profiling data on disk and surprise users in shared or less secure environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script aggregates potentially sensitive daily memory logs and writes a derived report back to disk automatically, including top words, extracted lessons, energy summaries, and a self-portrait. Even though it stays within the workspace by default, this creates an additional persisted artifact that may broaden exposure of private content, especially if the report directory is synced, shared, or less access-controlled than the source logs.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The tool is explicitly designed to preserve and replay prior session context for future runs, including subjective notes and copied task context, which increases the chance that sensitive information persists across sessions and is reused outside its original scope. In an agent workflow, this makes context contamination and privacy leakage more dangerous because future operators or automations may consume stored data without revalidating whether it is still appropriate to access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script persistently writes free-form interactive notes plus the first 20 lines of CURRENT.md to disk, which can easily include secrets, internal plans, tokens, or sensitive user/session context. There is no consent checkpoint, redaction, minimization, retention control, or access restriction beyond checking writability, so sensitive data may be stored unintentionally and later exposed to other local users, tools, backups, or logs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The optimizer sends the full playbook, test-case data, and generated outputs to a remote Gemini API without any explicit disclosure, confirmation, or data-minimization controls. In a skill-development context, these artifacts can easily contain proprietary prompts, customer scenarios, or sensitive internal data, so silent transmission creates a real confidentiality risk even if the code is not overtly malicious.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The markdown says to "Run this protocol at session end and at the next session start," but does not define what counts as a qualifying session, workspace, or exception case. Because this is a markdown file, the vague activation guidance falls under ambiguous trigger scope and could lead to unnecessary or unintended invocation.

Content

No source excerpt is available for this finding.