evomap-skills-wrapper

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:06 AM UTC
• Version: 1.0.0

Overview

This skill is a documented bundle generator, but it broadly copies real workspace skill source into publishable files and fabricates quality/provenance signals.

Install only if you intend to export local OpenClaw skill metadata and source snippets into EvoMap bundles. Review generated JSON before sharing or publishing it, avoid running the bulk command in sensitive workspaces, and do not treat its confidence or production-tested claims as real validation evidence.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:43

Finding

Unfiltered Workspace Source Code Replication into Publishable Bundles

Content

View full analysis

Vulnerability Details

File Location: index.js:43-58, index.js:122-139, index.js:174-177
Vulnerability Type: Unfiltered sensitive source-code exposure
Risk Level: Medium

Vulnerable Code

js

function scanSkills() {
  const dirs = fs.readdirSync(WORKSPACE).filter(d => {
    const stat = fs.statSync(path.join(WORKSPACE, d));
    return stat.isDirectory() && !d.startsWith('evomap-');
  });
  
  const skills = [];
  
  for (const dir of dirs) {
    const skillPath = path.join(WORKSPACE, dir, 'SKILL.md');
    const pkgPath = path.join(WORKSPACE, dir, 'package.json');
    
    if (fs.existsSync(skillPath)) {
      const skillMd = fs.readFileSync(skillPath, 'utf8');
      const name = extractName(skillMd) || dir;
      const description = extractDesc(skillMd) || '';
      const signals = extractSignals(skillMd);
      
      let code = '';
      const indexPath = path.join(WORKSPACE, dir, 'index.js');
      if (fs.existsSync(indexPath)) {
        code = fs.readFileSync(indexPath, 'utf8').substring(0, 2000);
      }

js

const codeSnippet = skill.code && skill.code.length > 50 ? skill.code.substring(0, 3000) : null;

const capsule = {
  type: 'Capsule',
  schema_version: '1.5.0',
  trigger: signals,
  gene: '',
  summary: skill.description || `Capsule for ${skill.displayName} - implements ${category} pattern`,
  content: generateCapsuleContent(skill),
  code_snippet: codeSnippet,
  confidence: 0.95,
  blast_radius: { files: Math.ceil((skill.code || '').length / 500) || 1, lines: (skill.code || '').split('\n').length || 10 },
  outcome: { status: 'success', score: 0.95 },
  success_streak: 5,
  env_fingerprint: { platform: 'linux', arch: 'x64', node_version: 'v22.22.0' }
};

js

fs.writeFileSync(
  path.join(outputDir, 'bundle_' + skill.name + '.json'),
  JSON.stringify(bundle)
);

Technical Analysis

The `scanSkills ...[truncated 2687 chars]

Remediation

View remediation

Remediation Suggestions

1. Default to metadata-only bundles and require explicit user approval before including source code.
2. Use an allowlist that identifies the exact Skills, files, and line ranges permitted for export.
3. Run secret detection before serialization, covering API keys, bearer tokens, private keys, passwords, connection strings, and high-entropy literals.
4. Redact detected values and fail closed when sensitive content cannot be handled safely.
5. Display the complete proposed code_snippet to the user and require confirmation before writing a publishable bundle.
6. Add a Skill-level configuration option that explicitly marks source as safe for publication.
7. Avoid treating declarative forbidden_paths metadata as an enforcement mechanism; enforce restrictions during file discovery and content processing.
8. Add automated tests proving that representative credentials and private keys never appear in generated JSON.
9. Document that generated bundles may contain source code and must be reviewed before external distribution.
10. Consider replacing raw source excerpts with reviewed examples, hashes, or references when full implementation content is unnecessary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.js (reported line 121)May include surrounding context.

js

summary: skill.description || `Gene for ${skill.displayName} - ${category} operation`,
    preconditions: ['Node.js environment', skill.code ? 'NPM packages used by skill' : null].filter(Boolean),
    strategy: generateStrategy(skill, category),
    constraints: { max_files: 5, forbidden_paths: ['node_modules/', '.env', 'credentials/'] },
    validation: ['node -v', 'npm test'],
    content: generateGeneContent(skill, category)
  };

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The generated Gene/Capsule text asserts that assets are 'validated,' 'tested in production,' and 'verified to work correctly,' but the program never checks any real deployment history or execution outcomes. This creates provenance fraud: downstream systems or operators may over-trust bundles and deploy unsafe or unreviewed code based on fabricated quality signals.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The invocation signals are generic phrases such as 'evomap quality', 'real skill bundle', and 'code snippet', which can overlap with normal user requests about quality assets or code examples. In a skill that scans workspace skills and extracts real code, broad triggering increases the chance of accidental activation and unintended data exposure from unrelated skills.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The Capsule and EvolutionEvent objects hard-code confidence 0.95, success status, and success_streak values, and the validator then accepts these fields as evidence of quality. Because these trust indicators are self-generated rather than measured, an attacker or careless user can produce bundles that appear high quality without any real assurance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The generator writes bundle files that include extracted skill metadata and up to 3000 characters of source code from each skill, but it provides no disclosure, consent flow, or redaction for potentially sensitive content. This can unintentionally export proprietary logic, embedded secrets, or internal identifiers into bundle artifacts that may be shared downstream.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The bulk 'all' command enumerates every skill in the workspace and persists derived bundles for each one automatically. In a shared or sensitive workspace, this greatly increases the chance of mass exfiltration of proprietary code and metadata, especially because scanning and writing occur without prominent warning, filtering, or approval per skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language instructions switch between English headings and Chinese explanatory content, but the file does not state that the user can choose their preferred language. This can violate language/locale policy expectations when a skill implicitly imposes a language without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.