Security audit

Evolution Toolkit

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent local self-improvement toolkit, but it needs review because it can persist sensitive behavioral memory and send local playbooks/test cases to Gemini using workspace credentials with limited disclosure.

Review before installing, especially if your workspace contains private notes, customer data, proprietary prompts, or broad .secrets files. Use a dedicated test workspace, prefer explicit environment variables over workspace .secrets, avoid running the optimizer on confidential playbooks unless external Gemini processing is acceptable, and treat the thinking-partner protocol as opt-in rather than a default behavior policy.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: protocols/thinking-partner.md:5
Finding: Cross-Task Agent Behavior Hijacking Through a Default Personalized Protocol
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:23
Finding: Unpinned Third-Party Package Execution in Installation Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/skill-optimizer.js:69
Finding: Automatic Workspace Secret Access and External Transmission of Local Playbook Content
Content: View full analysis
{ const match = line.match(/^([A-Z0-9_]+)=(.+)$/); if (match) secrets[match[1]] = match[2].trim(); }); return secrets; } function getApiKey(config = {}) { const envKey = process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY; if (envKey) return envKey; const secrets = loadSecrets(); if (secrets.GEMINI_API_KEY) return secrets.GEMINI_API_KEY; if (secrets.GOOGLE_API_KEY) return secrets.GOOGLE_API_KEY; if (config.apiKeyEnvVar && process.env[config.apiKeyEnvVar]) { return process.env[config.apiKeyEnvVar]; } return null; } ``` The API key is embedded in the request URL: ```javascript const options = { hostname: 'generativelanguage.googleapis.com', path: `/v1beta/models/${model}:generateContent?key=${apiKey}`, method: 'POST', headers: { 'Content-Type': 'application/json' } }; ``` Configured test cases and local playbook content are placed into prompts sent to the external API: ```javascript async function generateOutput(skill, testCase, playbook, apiKey) { const prompt = `You are improving a reusable playbook through realistic task trials. TASK CASE: ${JSON.stringify(testCase, null, 2)} PLAYBOOK: """ ${playbook} """ GENERATION INSTRUCTION: ${skill.generatorPrompt} Output ONLY the final artifact for this test case.`; return callGemini(prompt, apiKey, skill.model); } ``` The improvement flow also sends up to 4,000 characters from the current playbook: ```javasc ...[truncated 3208 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (31)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
`scripts/session-imprint.js`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.
md
`scripts/session-imprint.js`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
`scripts/cognitive-fingerprint.js`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.
md
`scripts/cognitive-fingerprint.js`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
`scripts/contradiction-scanner.js`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.
md
`scripts/contradiction-scanner.js`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
`scripts/predict.js`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.
md
`scripts/predict.js`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
md
`scripts/skill-optimizer.js`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
md
`scripts/skill-optimizer.js`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.
md
`scripts/skill-optimizer.js`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
md
`scripts/socratic-mode.js`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
`scripts/socratic-mode.js`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
md
`scripts/session-coherence.js`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
`scripts/session-coherence.js`

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · scripts/contradiction-scanner.js (reported line 108)May include surrounding context.
js
} } }); return directives; } function extractFilePaths(content, source) {

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The README instructs users to run npx clawhub install ergopitrez/evolution-toolkit without pinning the clawhub package to a specific version. Because npx fetches and executes the latest matching package at runtime, a compromised upstream package, typo-squatted package, or malicious new release could result in arbitrary code execution on the operator's machine during installation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The phase-detection rules use very broad trigger phrases such as 'Build', 'Write', and 'Create' to infer Execution mode. In practice, ordinary exploratory or advisory requests can contain these words, causing the agent to prematurely switch into a mode that 'reduce[s] friction ruthlessly' and 'move[s] fast' while suppressing re-examination. That can bypass useful caution or clarification and lead to over-eager action on ambiguous requests.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script’s header and usage text present it as a computation/display tool, but later logic automatically persists generated fingerprints to disk by default. Because these fingerprints are derived from potentially sensitive text samples and stored in a user workspace history file, the undocumented persistence can violate user expectations and create privacy risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script auto-saves single-run fingerprints unless --no-save is passed, which means users may persist behavioral or cognitive-profile metadata without realizing it. Even if the raw text is not stored, the resulting history can still reveal patterns about a user’s writing, reasoning style, and activity over time, making the silent default persistence privacy-sensitive.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module header says the scanner will surface 'Orphaned decisions' and 'Model/tool name drift'. In the implementation, there is no logic for orphaned decision detection, and although TOOL_DRIFT is defined, it is never used to scan content or report findings, so the documented capabilities actively overstate what the script does.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script generates a sensitive behavioral/profile report from memory logs and writes it to a persistent file under the workspace without an explicit consent step, privacy warning, or opt-in save behavior. In this context, the output includes recurring themes, emotional markers, and lessons learned, which can expose personal or operationally sensitive information if the workspace is shared, synced, backed up, or later accessed by other tools/users.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script is explicitly designed to preserve prior session context for future runs, creating a persistent natural-language memory channel. In agent environments, such channels can unintentionally carry forward sensitive instructions, internal data, or secrets into later sessions where they may be exposed more broadly than intended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The tool persistently stores free-form user reflections plus copied content from CURRENT.md without an explicit consent, privacy, or retention warning at the point of capture. Because users may enter sensitive operational notes, credentials, personal data, or internal context, this creates a durable disclosure channel within the workspace that later users, agents, backups, or sync processes may access.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Copying the first 20 lines of CURRENT.md into each persistent imprint duplicates potentially sensitive task context into an additional file, increasing the attack surface and long-term exposure of that information. Even without network exfiltration, this broadens disclosure to any process or person with access to the workspace or its backups.
Content: No source excerpt is available for this finding.