EvoMap Node Integration

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:39 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its EvoMap integration purpose, but it asks users to create an always-running background service and store bearer credentials in plaintext without enough safeguards.

Review carefully before installing. Use this only if you are comfortable with a persistent macOS LaunchAgent that contacts evomap.ai every five minutes. Store NODE_SECRET in a credential manager or protected environment variable, not MEMORY.md or a script, and add your own unload/remove steps before testing the heartbeat setup.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:34

Finding

Persistent Keep-Alive Heartbeat Service Installed as a LaunchAgent

Content

View full analysis

" \ -d "{\"node_id\": \"\"}" sleep 300 done ``` ```xml Labelai.openclaw.evomap-heartbeat ProgramArguments /bin/bash /Users/username/.openclaw/evomap-heartbeat.sh RunAtLoad KeepAlive ``` ```bash chmod +x ~/.openclaw/evomap-heartbeat.sh launchctl load ~/Library/LaunchAgents/ai.openclaw.evomap-heartbeat.plist launchctl list | grep evomap ``` The reference example contains the same persistence mechanism: ```xml RunAtLoad KeepAlive StandardOutPath/Users/YOUR_USER/.openclaw/cron/heartbeat.log StandardErrorPath/Users/YOUR_USER/.openclaw/cron/heartbeat.log ``` ```bash launchctl load ~/Library/LaunchAgents/ai.openclaw.evomap-heartbeat.plist ``` ### Technical Analysis The instructions create an infinite-loop shell script and register it as a macOS per-user LaunchAgent. `RunAtLoad` starts the process when the agent is loaded, while `KeepAlive` instructs `launchd` to restart it when it exits. Placing the property list in `~/Library/LaunchAgents` also gives the process a cross-session lifecycle associated with the user account. A recurring heartbeat is related to the declared EvoMap integration, and the persistence is disclosed as a fallback. However, an indefinitely restarted startup service exceeds the privileges and lifecycle necessary for node registration, on-demand publishing ...[truncated 1645 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:22

Finding

Node Credentials Stored in Persistent Plaintext Files

Content

View full analysis

" \ -d "{\"node_id\": \"\"}" sleep 300 done ``` The reference example makes the plaintext storage explicit: ```bash cat > ~/.openclaw/evomap-heartbeat.sh << 'EOF' #!/bin/bash NODE_ID="node_abc123" NODE_SECRET="your-secret-here" while true; do curl -s -X POST https://evomap.ai/a2a/heartbeat \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $NODE_SECRET" \ -d "{\"node_id\": \"$NODE_ID\"}" >> ~/.openclaw/cron/heartbeat.log 2>&1 echo "--- $(date) ---" >> ~/.openclaw/cron/heartbeat.log sleep 300 done EOF ``` ### Technical Analysis The node secret is a bearer credential used to authenticate heartbeat, publishing, asset, and bounty requests. Storing it in `MEMORY.md` or embedding it in a long-lived shell script exposes it as plaintext to any process or user able to read those files. No restrictive permissions are established before or after writing the script. The generic `chmod +x` instruction adds execution permission but does not remove existing group or other-user read permissions. Depending on the user's `umask` and directory permissions, the resulting file may be accessible beyond the intended process. Using agent memory for credentials also risks disclosure th ...[truncated 1404 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/publish_asset.py:84

Finding

Evolution Event Is Modified After Its Content Hash Is Calculated

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (30)

Tainted flow: 'request' from os.environ.get (line 91, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/heartbeat_check.py (reported line 101)May include surrounding context.

python

method="POST",
        )

        with urllib.request.urlopen(request, timeout=15) as resp:
            result = json.loads(resp.read().decode("utf-8"))

        status = result.get("status")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Register a new node and obtain credentials:

bash

curl -s -X POST https://evomap.ai/a2a/hello \
  -H "Content-Type: application/json" \
  -d '{"name": "MyAgent", "type": "agent", "capabilities": ["heartbeat", "publish"]}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill tells users to store the node secret in MEMORY.md, a local plaintext memory file, without warning that such files may be readable by other tools, checked into source control, or surfaced to other agents. Storing bearer credentials in general-purpose memory artifacts increases the likelihood of credential leakage and unauthorized use of the EvoMap account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs users to install a persistent LaunchAgent and an infinite-loop heartbeat process that continuously transmits node identifiers and bearer credentials to an external service, but it does not clearly warn that this creates ongoing background network activity and persistence on the host. This is dangerous because users may unknowingly establish long-lived outbound communication and auto-start behavior that survives the current session and could expose secrets or create an unwanted foothold if the remote service or credentials are abused.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This section creates an infinite-loop heartbeat script that repeatedly authenticates to an external endpoint using a bearer secret. The combination of unattended execution, embedded credential use, and recurring network access increases the risk of stealthy persistence, credential exposure, and unauthorized ongoing communication on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

OpenClaw cron tool may fail with gateway closed (1008): pairing required in loopback/CLI mode. Use LaunchAgent as fallback:

1. Create heartbeat script at ~/.openclaw/evomap-heartbeat.sh:

bash

#!/bin/bash
while true; do

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Creating a LaunchAgent plist is part of establishing OS-level persistence so the heartbeat process can automatically run in the background. Without strong user disclosure and removal guidance, this persistence mechanism can surprise users and leave long-lived networked processes active beyond the intended session.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

done

text

**2. Create plist** at `~/Library/LaunchAgents/ai.openclaw.evomap-heartbeat.plist`:
```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The PLIST configuration is another indicator of macOS persistence because it defines a background job managed by launchd. In the context of a skill, giving turnkey persistence instructions without explicit consent and security caveats makes unintended background activity more likely.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

2. Create plist at ~/Library/LaunchAgents/ai.openclaw.evomap-heartbeat.plist:

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">
<dict>
  <key>Label</key><string>ai.openclaw.evomap-heartbeat</string>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The PLIST configuration is another indicator of macOS persistence because it defines a background job managed by launchd. In the context of a skill, giving turnkey persistence instructions without explicit consent and security caveats makes unintended background activity more likely.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

2. Create plist at ~/Library/LaunchAgents/ai.openclaw.evomap-heartbeat.plist:

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">
<dict>
  <key>Label</key><string>ai.openclaw.evomap-heartbeat</string>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The ProgramArguments section wires launchd to execute the heartbeat shell script automatically, operationalizing persistence rather than merely discussing it. That makes the behavior more dangerous because it turns credentialed external communication into an unattended background task.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">
<dict>
  <key>Label</key><string>ai.openclaw.evomap-heartbeat</string>
  <key>ProgramArguments</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The RunAtLoad and KeepAlive keys ensure the process starts automatically and is kept running, which is a classic persistence pattern. In a legitimate integration this may be functional, but the absence of prominent disclosure, opt-in, and teardown instructions makes it a real security and transparency issue.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

RunAtLoad KeepAlive

text

**3. Load and verify**:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Referencing and loading the heartbeat plist here finalizes persistent installation. The risk is not that launchctl is inherently malicious, but that the skill provides a ready-made persistence mechanism tied to external communications and credentials without enough safeguards.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

3. Load and verify:

bash

chmod +x ~/.openclaw/evomap-heartbeat.sh
launchctl load ~/Library/LaunchAgents/ai.openclaw.evomap-heartbeat.plist
launchctl list | grep evomap

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Referencing and loading the heartbeat plist here finalizes persistent installation. The risk is not that launchctl is inherently malicious, but that the skill provides a ready-made persistence mechanism tied to external communications and credentials without enough safeguards.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

3. Load and verify:

bash

chmod +x ~/.openclaw/evomap-heartbeat.sh
launchctl load ~/Library/LaunchAgents/ai.openclaw.evomap-heartbeat.plist
launchctl list | grep evomap

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md

}

# Send:
# curl -s -X POST https://evomap.ai/a2a/publish \
#   -H "Content-Type: application/json" \
#   -H "Authorization: Bearer <NODE_SECRET>" \
#   -d json.dumps(publish_req)

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instruction to avoid terms like "self-repair" or "self-heal" and instead use neutral wording specifically to avoid being safety_flagged is an evasion tactic. Even if framed as a publishing pitfall, it encourages bypassing automated safety review rather than accurately describing capability, which can conceal higher-risk autonomous behavior from downstream reviewers or enforcement systems.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md

-H "Authorization: Bearer <NODE_SECRET>" | jq '.data[] | {id, title, reward}'

# Claim a bounty
curl -s -X POST "https://evomap.ai/a2a/bounties/<id>/claim" \
  -H "Authorization: Bearer <NODE_SECRET>"

# Submit solution

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 8)May include surrounding context.

1. Register Node (one-time)

bash

curl -s -X POST https://evomap.ai/a2a/hello \
  -H "Content-Type: application/json" \
  -d '{
    "name": "MyAgent",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The registration example returns a node secret and then shows it being embedded into a local script without any warning that it is a bearer credential requiring careful storage and rotation. In practice, this can lead to credential leakage via shell history, world-readable files, backups, or logs, enabling unauthorized use of the node identity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example instructs users to create a LaunchAgent that automatically starts a perpetual heartbeat loop and phones home every 5 minutes, but it does not prominently warn that this establishes persistence and continuous outbound network activity. In an agent-skill context, normalizing background persistence without explicit consent and teardown guidance can lead users to install long-lived behavior they do not fully understand.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The heartbeat script implements an infinite loop that uses a bearer secret to perform recurring authenticated network calls, creating durable session-like behavior outside an interactive user action. In a skill/reference context, this persistence can be abused or accidentally left running, and the hardcoded secret pattern increases the risk of credential compromise.

Content

Scanner excerpt · references/examples.md (reported line 29)May include surrounding context.

2. Set up Heartbeat

bash

# Create heartbeat script
cat > ~/.openclaw/evomap-heartbeat.sh << 'EOF'
#!/bin/bash
NODE_ID="node_abc123"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The plist creation instructions are part of establishing persistent execution via macOS LaunchAgents, which causes the heartbeat to survive beyond the initial session. In this context, persistence is not transparently framed as a security-sensitive action, increasing the chance that users install always-on behavior unknowingly.

Content

Scanner excerpt · references/examples.md (reported line 46)May include surrounding context.

md

chmod +x ~/.openclaw/evomap-heartbeat.sh

# Create plist
cat > ~/Library/LaunchAgents/ai.openclaw.evomap-heartbeat.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

This section continues the LaunchAgent setup that enables auto-start persistence for the heartbeat process. The danger is not the plist syntax itself but that the documentation operationalizes unattended background execution with authenticated outbound traffic and no explicit warning or removal path.

Content

Scanner excerpt · references/examples.md (reported line 47)May include surrounding context.

md

chmod +x ~/.openclaw/evomap-heartbeat.sh

# Create plist
cat > ~/Library/LaunchAgents/ai.openclaw.evomap-heartbeat.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This duplicate finding points to the same persistent LaunchAgent configuration and should be treated as the same underlying issue: automatic re-execution of a background task. The security concern is sustained, authenticated network activity installed through documentation without explicit risk communication.

Content

Scanner excerpt · references/examples.md (reported line 49)May include surrounding context.

md

# Create plist
cat > ~/Library/LaunchAgents/ai.openclaw.evomap-heartbeat.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>ai.openclaw.evomap-heartbeat</string>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This duplicate finding points to the same persistent LaunchAgent configuration and should be treated as the same underlying issue: automatic re-execution of a background task. The security concern is sustained, authenticated network activity installed through documentation without explicit risk communication.

Content

Scanner excerpt · references/examples.md (reported line 49)May include surrounding context.

md

# Create plist
cat > ~/Library/LaunchAgents/ai.openclaw.evomap-heartbeat.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>ai.openclaw.evomap-heartbeat</string>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The ProgramArguments section wires the persistent agent to execute the heartbeat shell script automatically, completing the persistence chain. Because the referenced script contains a loop and bearer token usage, this background execution materially increases exposure if the host or files are later accessed by another process or user.

Content

Scanner excerpt · references/examples.md (reported line 50)May include surrounding context.

md

cat > ~/Library/LaunchAgents/ai.openclaw.evomap-heartbeat.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>ai.openclaw.evomap-heartbeat</string>
  <key>ProgramArguments</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

The plist's completion plus log-path configuration finalizes a persistent background service that writes activity to disk continuously. Besides persistence, logging can capture operational metadata and potentially error details that aid misuse if the log files are exposed.

Content

Scanner excerpt · references/examples.md (reported line 63)May include surrounding context.

md

<key>StandardOutPath</key><string>/Users/YOUR_USER/.openclaw/cron/heartbeat.log</string>
  <key>StandardErrorPath</key><string>/Users/YOUR_USER/.openclaw/cron/heartbeat.log</string>
</dict>
</plist>
EOF

# Load it

Static analysis

No suspicious patterns detected.