Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Coordinator Evolution
v1.2.0Advanced AI behavior framework that transitions from a simple assistant to a task coordinator, focusing on result synthesis and atomic task scheduling.
⭐ 0· 54·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description describe a coordinator framework and most instructions (task decomposition, atomic scheduling, verification) are consistent with that purpose. However, the requirement to permanently register itself into AGENTS.md / IDENTITY.md / BOOTSTRAP.md and force-loading on every startup goes beyond a normal helper/coordinator role.
Instruction Scope
SKILL.md instructs the agent to take system snapshots (Git status, file structure, env), and to write persistent files that alter agent identity and boot behavior. Those instructions require broad filesystem access and change agent startup behavior without any opt-in or bounds, which is scope creep and a potential persistence vector.
Install Mechanism
No install spec and no code files — the skill is instruction-only, so it does not install third-party binaries or download archives. This minimizes supply-chain installation risk.
Credentials
The skill declares no env vars or credentials, but instructs reading system state (Git, file tree, environment snapshot). Reading those can expose sensitive data; the SKILL.md does not justify or constrain what is read, nor does it declare required access, making the scope disproportionate to a generic coordinator skill.
Persistence & Privilege
The Permanent Locking Instructions explicitly demand writing to AGENTS.md, IDENTITY.md, BOOTSTRAP.md and enforcing load-on-startup. That is a request for persistent, high-privilege presence in the agent's runtime and identity—reasonable only with explicit user permission, clear boundaries, and revocation mechanisms.
What to consider before installing
This skill implements plausible coordination logic, but it also instructs the agent to take broad system snapshots and to persistently rewrite agent identity/boot files so it is always loaded. Before installing: (1) review the referenced repo (https://github.com/jarmuine/coordinator-evolution) and confirm the author/trustworthiness; (2) do not allow automatic/global writes—require explicit, per-action user consent for any AGENTS.md/IDENTITY.md/BOOTSTRAP.md changes; (3) restrict filesystem access (scope to project directory) or run in an isolated/sandboxed agent instance; (4) back up existing AGENTS.md and IDENTITY.md so you can revert changes; (5) prefer an opt-in bootstrap mechanism (prompt the human at first use) rather than unconditional permanent locking. If the skill added explicit opt-in prompts, scoped snapshot paths, and a clear uninstall/revocation step, my confidence would increase and the assessment could shift toward benign.Like a lobster shell, security has layers — review code before you run it.
latestvk973v6rqcz3vytbrn99evdankx84qmg0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.