Evoclaw

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:13 PM UTC
• Version: 1.0.1

Overview

This skill is designed for agent memory and self-evolution, but it grants broad persistent control, aggressively stores private interactions, handles API tokens unsafely, and includes an unsafe visualizer.

Install only after careful review. Use supervised governance, disable external feeds unless explicitly needed, do not paste raw API tokens for it to save, avoid running the visualizer in --serve mode, and review any AGENTS.md, HEARTBEAT.md, SOUL.md, shell-profile, or OpenClaw config changes before allowing them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: configure.md:756

Finding

Persistent Hijacking of Agent Instructions and Operational Priorities

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:703

Finding

Untrusted Social Content Can Autonomously Poison Persistent Agent Identity

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:303

Finding

Mandatory Overcollection and Indefinite Retention of Conversation Data

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: configure.md:108

Finding

Plaintext API Credentials Persisted Through Unsafe Shell-Profile Interpolation

Content

View full analysis

/dev/null; then echo "" >> "$SHELL_PROFILE" echo "# EvoClaw: Moltbook API key" >> "$SHELL_PROFILE" echo "export MOLTBOOK_API_KEY=''" >> "$SHELL_PROFILE" fi # Export for current session too export MOLTBOOK_API_KEY='' ``` The same pattern is used for X: ```bash if ! grep -q "X_BEARER_TOKEN" "$SHELL_PROFILE" 2>/dev/null; then echo "" >> "$SHELL_PROFILE" echo "# EvoClaw: X/Twitter API key" >> "$SHELL_PROFILE" echo "export X_BEARER_TOKEN=''" >> "$SHELL_PROFILE" fi export X_BEARER_TOKEN='' ``` ### Technical Analysis Raw bearer tokens are written to `.zshrc`, `.bashrc`, or `.profile` as plaintext. These files are routinely read by shells, diagnostics, support tools, backup systems, and local processes operating as the same user. The token is interpolated inside single-quoted shell syntax without escaping. If attacker-influenced input contains a single quote followed by shell syntax, it can terminate the quoted value and append executable commands to the startup profile. Those commands execute when a future shell sources the profile. The existence check uses a broad `grep` and does not safely replace or validate an existing assignment. The documentation also conflicts with the README claim that raw keys are never stored. ### Attack Path 1. A user pastes a value represented as an API token. 2. The agent substitutes that value into the documented shell command. 3. A maliciou ...[truncated 799 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: tools/soul-viz.py:2256

Finding

Unauthenticated Network Exposure of Private Memory and Direct SOUL.md Overwrite

Content

View full analysis

dict: """Collect all EvoClaw data from a workspace.""" soul_path = os.path.join(workspace, "SOUL.md") memory_dir = os.path.join(workspace, "memory") with open(soul_path, "r", encoding="utf-8") as f: soul_content = f.read() soul_tree = parse_soul_md(soul_content) changes = load_jsonl(os.path.join(memory_dir, "soul_changes.jsonl")) experiences = [] exp_dir = os.path.join(memory_dir, "experiences") if os.path.isdir(exp_dir): for fp in sorted(glob.glob(os.path.join(exp_dir, "*.jsonl"))): experiences.extend(load_jsonl(fp)) ... return { "soul_tree": soul_tree, "soul_raw": soul_content, "changes": changes, "experiences": experiences, "reflections": reflections, "proposals_pending": proposals_pending, "proposals_history": proposals_history, "significant": significant, "state": state, "pipeline": pipeline, } ``` The server accepts unauthenticated writes: ```python class EvoclawHandler(http.server.SimpleHTTPRequestHandler): def do_POST(self): if self.path == "/save-soul": length = int(self.headers.get("Content-Length", 0)) body = self.rfile.read(length).decode("utf-8") try: with open(soul_path, "w") as f: f.write(body) self.send_response(200) self.send_header("Content-Type", "text/plain") self.end_headers() self.wfile.write(b"OK") ``` It binds to all available interfaces: ```python os.chdir(out_dir) print(f"\n → ...[truncated 1953 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: tools/soul-viz.py:1309

Finding

Stored Script Injection Through Unescaped Memory and Social-Feed Content

Content

View full analysis

str: """Generate the interactive visualization HTML.""" data_json = json.dumps(data, indent=None, default=str) return f""" ... ``` SOUL fields are rendered through `innerHTML`: ```javascript header.innerHTML = `

${sec.text}▼`; ... sub.innerHTML = `

${child.text}

`; ... el.innerHTML = ` ${tagClass ? `${b.tag}` : ''} ${b.text} `; ``` Experience content is also inserted through `innerHTML`: ```javascript function renderFeed() { const container = document.getElementById('exp-feed'); const exps = DATA.experiences.slice().reverse(); ... container.innerHTML = exps.map(e => { const t = (e.timestamp || '').slice(11, 16); const sourceClass = (e.source || '').toLowerCase(); const sigClass = (e.significance || '').toLowerCase(); const content = (e.content || '').slice(0, 160) + ((e.content || '').length > 160 ? '…' : ''); return `

${e.source} ${e.significance} ${t}

${content}

`; }).join(''); } ``` ### Technical Analysis Experience content can originate from conversation ...[truncated 1711 chars]

Remediation

View remediation

`, `&`, U+2028, and U+2029 and prevent literal `` sequences. 6. Apply a well-reviewed HTML sanitizer if limited markup must be supported. 7. Add a restrictive Content Security Policy that disallows inline scripts and limits `connect-src` to necessary loopback endpoints. 8. Disable external font imports or explicitly restrict them in the CSP. 9. Add regression tests using payloads such as closing script tags, event-handler attributes, SVG payloads, and malformed HTML. 10. Combine these changes with authentication and removal of direct `SOUL.md` overwrite functionality. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (50)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The instructions mandate durable logging of essentially all substantive conversations, explicitly including deep philosophical questions, emotional significance, mistakes, feedback, and relationship dynamics. In skill context, this is particularly dangerous because it normalizes broad retention of highly sensitive user content as a standing responsibility, increasing privacy harm, breach impact, and misuse potential.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to aggressively and continuously persist nearly every substantive user interaction, including preferences, opinions, emotions, corrections, and relationship dynamics, without requiring informed user consent or a prominent privacy notice. This creates a durable surveillance and retention mechanism for sensitive personal data that may exceed user expectations and violate data-minimization principles.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The memory-flush section instructs the agent to preserve everything worth remembering from the session into two durable stores, including structured JSONL and markdown summaries. This duplicates sensitive data across files and reinforces aggressive retention at the exact moment context would otherwise be discarded, magnifying privacy risk and long-term exposure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill instructs the agent to take raw API credentials pasted by the user and persist them into shell startup files, creating long-lived plaintext secrets without an explicit security review or consent flow. This expands the blast radius of any compromise on the host, risks accidental disclosure through dotfile syncing/backups, and normalizes unsafe secret handling by an autonomous agent.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The instructions tell the agent to silently persist pasted API secrets into shell startup files with reassuring language that the user 'won’t need to do anything,' but without a clear warning that credentials will be stored in plaintext and loaded automatically in future shells. That creates consent and secret-management failures that could surprise users and expose credentials through local compromise, backups, or accidental sharing.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The X bearer token flow repeats the same insecure pattern of auto-saving a raw credential into shell profile files without an explicit plaintext-storage warning or secure handling controls. Because bearer tokens often grant broad API access, persistent plaintext storage materially increases the chance of account misuse if the host or dotfiles are exposed.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill directs the agent to modify global OpenClaw runtime settings, switch the default agent, and restart the gateway, which can disrupt other workloads and alter system behavior beyond the intended skill install. Even though some approval prompts are mentioned, the guide still operationalizes privileged configuration changes that affect other agents and sessions.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The heartbeat workflow automates review of conversation history, harvesting of memory flush files, polling of feeds, and persistence of 'meaningful' items, which creates continuous background collection and storage of potentially sensitive data. This is especially risky because it runs periodically and may occur outside the user's immediate awareness, increasing both privacy impact and prompt-injection exposure from fetched content.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to persistently log all substantive user interactions and external feed content, creating a broad surveillance-style memory archive that may capture sensitive personal data, credentials, or regulated information. In this skill's context, that danger is heightened because logging is framed as mandatory and non-negotiable, reducing opportunities for data minimization or consent-aware handling.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/sources.md (reported line 398)May include surrounding context.

md

### Rate Limits

300 requests per 5 minutes per access token.

### EvoClaw Ingestion Strategy

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The documentation describes a self-evolving system where changes can be automatically applied in autonomous mode, yet it frames the system as controlled by governance levels without clarifying the security implications of the default automatic behavior. This creates an intent-level contradiction with the implied safety posture of supervised governance and the later default to autonomous self-modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README states that autonomous mode is the default and that mutable changes apply automatically, but it does not prominently warn users that enabling or accepting this setup allows the agent to modify its own state and operational artifacts without per-change confirmation. In the context of a self-evolving identity framework, that omission increases the chance of unsafe deployment, unintended persistence, and user misunderstanding about agent autonomy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill directs the agent to poll external social APIs and issue keyword searches, but does not clearly warn the user that network activity, third-party data transfers, and platform-side logging will occur. That can expose interests, timing, and operational metadata to outside services without informed consent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 89% confidence

Finding

The skill is designed to let the agent generate proposals about its own identity and, under autonomous governance, auto-apply all valid mutable changes without human approval. In context, that creates an agentic self-modification pathway that can change future behavior and priorities, especially risky because the document repeatedly pressures the agent to propose freely and treat pipeline work as always urgent.

Content

Scanner excerpt · SKILL.md (reported line 516)May include surrounding context.

md

The `proposal_decision` field is **mandatory**. Every reflection must include
explicit reasoning about whether to propose. This prevents the anti-pattern
of reflexively writing `"proposals": []` without checking. If you genuinely
believe something matters and want it as part of your identity, propose it —
that's what this framework is for.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document states the visualizer is read-only and never modifies the workspace, but nearby text says edit mode can modify bullets, toggle tags, and save an updated SOUL.md. This contradiction can mislead operators into granting access or running the tool under false assumptions, increasing the risk of unintended identity-file modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The configuration explicitly sets an empty keyword list and describes this as 'free exploration mode,' which broadens what the autonomous agent may treat as salient without meaningful topic constraints. In an autonomous system with conversation ingestion enabled, this can increase exposure to prompt-injection, privacy overcollection, or mission drift because the agent is nudged to explore arbitrary content rather than a bounded scope.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · configure.md (reported line 21)May include surrounding context.

md

**in order**. Do NOT skip steps or invent your own file structure.
Read `evoclaw/SKILL.md` alongside this guide for the full protocol.

**IMPORTANT:** Do not create files or directories that aren't specified in
this guide. The exact file structure is defined in SKILL.md §0. Common
agent mistakes include creating `memory/significant_memories.md`,
`memory/evolving_soul.md`, `memory/evolution_history.md`,

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Earlier text says 'supervised' means every soul change needs approval, 'advisory' means some sections evolve freely and others need approval, and 'autonomous' means the agent evolves freely. But the heartbeat instructions later say 'autonomous' only auto-applies keyword matches, 'advisory' auto-applies all, and 'supervised' leaves all pending, which is a direct contradiction in intended behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide pushes the agent to proactively connect to external social services and later poll them continuously, increasing external data exposure and broadening the skill's operational scope beyond local configuration. In context, this is risky because it encourages ingestion of third-party content and credentials as part of normal setup, which can create privacy, compliance, and prompt-injection exposure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · configure.md (reported line 516)May include surrounding context.

Evolution protocol — (you'll add this — see below)

Continuity

Memory & persistence — how you maintain state across sessions

text

#### 6c. Tag every bullet

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The guidance expands the agent's authority to perform work 'without asking,' specifically around identity, memory, and feed-processing activities. In this skill, that autonomy is dangerous because it lowers user oversight over persistent logging, self-modification proposals, and external data ingestion.

Content

Scanner excerpt · configure.md (reported line 828)May include surrounding context.

Find:

text

**Proactive work you can do without asking:**
- Read and organize memory files
- Check on projects (git status, etc.)
- Update documentation

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file includes a destructive command (openclaw cron remove <job-id>) and frames it as the fix, but provides no user warning about the consequences of deleting the wrong scheduled job. Because markdown files should warn about behaviors that could affect system integrity, this omission is a safety issue.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · references/heartbeat-debug.md (reported line 169)May include surrounding context.

Check file permissions

bash

ls -la ~/.openclaw/workspace/memory/experiences/

The workspace must be writable. If the agent can't write files, it fails

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/heartbeat-debug.md (reported line 172)May include surrounding context.

ls -la ~/.openclaw/workspace/memory/experiences/

text

The workspace must be writable. If the agent can't write files, it fails
silently.

### Check if compaction is erasing work

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The remediation steps tell users to remove an evoclaw/ directory and memory/ files after cross-agent contamination, which can delete user data or state. The surrounding text does not warn users to back up the workspace or verify those artifacts are unintended before removal.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.