evomap-skills-wrapper

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:06 AM UTC
• Version: 1.0.0

Overview

This skill is a documented bundle generator, but it broadly copies real workspace skill source into publishable files and fabricates quality/provenance signals.

Install only if you intend to export local OpenClaw skill metadata and source snippets into EvoMap bundles. Review generated JSON before sharing or publishing it, avoid running the bulk command in sensitive workspaces, and do not treat its confidence or production-tested claims as real validation evidence.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:43
• Finding: Unfiltered Workspace Source Code Replication into Publishable Bundles## Vulnerability Details **File Location**: `index.js:43-58`, `index.js:122-139`, `index.js:174-177` **Vulnerability Type**: Unfiltered sensitive source-code exposure **Risk Level**: Medium ### Vulnerable Code ```js function scanSkills() { const dirs = fs.readdirSync(WORKSPACE).filter(d => { const stat = fs.statSync(path.join(WORKSPACE, d)); return stat.isDirectory() && !d.startsWith('evomap-'); }); const skills = []; for (const dir of dirs) { const skillPath = path.join(WORKSPACE, dir, 'SKILL.md'); const pkgPath = path.join(WORKSPACE, dir, 'package.json'); if (fs.existsSync(skillPath)) { const skillMd = fs.readFileSync(skillPath, 'utf8'); const name = extractName(skillMd) || dir; const description = extractDesc(skillMd) || ''; const signals = extractSignals(skillMd); let code = ''; const indexPath = path.join(WORKSPACE, dir, 'index.js'); if (fs.existsSync(indexPath)) { code = fs.readFileSync(indexPath, 'utf8').substring(0, 2000); } ``` ```js const codeSnippet = skill.code && skill.code.length > 50 ? skill.code.substring(0, 3000) : null; const capsule = { type: 'Capsule', schema_version: '1.5.0', trigger: signals, gene: '', summary: skill.description || `Capsule for ${skill.displayName} - implements ${category} pattern`, content: generateCapsuleContent(skill), code_snippet: codeSnippet, confidence: 0.95, blast_radius: { files: Math.ceil((skill.code || '').length / 500) || 1, lines: (skill.code || '').split('\n').length || 10 }, outcome: { status: 'success', score: 0.95 }, success_streak: 5, env_fingerprint: { platform: 'linux', arch: 'x64', node_version: 'v22.22.0' } }; ``` ```js fs.writeFileSync( path.join(outputDir, 'bundle_' + skill.name + '.json'), JSON.stringify(bundle) ); ``` ### Technical Analysis The `scanSkills ...[truncated 2687 chars]
• Remediation: ## Remediation Suggestions 1. Default to metadata-only bundles and require explicit user approval before including source code. 2. Use an allowlist that identifies the exact Skills, files, and line ranges permitted for export. 3. Run secret detection before serialization, covering API keys, bearer tokens, private keys, passwords, connection strings, and high-entropy literals. 4. Redact detected values and fail closed when sensitive content cannot be handled safely. 5. Display the complete proposed `code_snippet` to the user and require confirmation before writing a publishable bundle. 6. Add a Skill-level configuration option that explicitly marks source as safe for publication. 7. Avoid treating declarative `forbidden_paths` metadata as an enforcement mechanism; enforce restrictions during file discovery and content processing. 8. Add automated tests proving that representative credentials and private keys never appear in generated JSON. 9. Document that generated bundles may contain source code and must be reviewed before external distribution. 10. Consider replacing raw source excerpts with reviewed examples, hashes, or references when full implementation content is unnecessary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

• Category: Privilege Escalation

Content

summary: skill.description || `Gene for ${skill.displayName} - ${category} operation`,
    preconditions: ['Node.js environment', skill.code ? 'NPM packages used by skill' : null].filter(Boolean),
    strategy: generateStrategy(skill, category),
    constraints: { max_files: 5, forbidden_paths: ['node_modules/', '.env', 'credentials/'] },
    validation: ['node -v', 'npm test'],
    content: generateGeneContent(skill, category)
  };

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The generated Gene/Capsule text asserts that assets are 'validated,' 'tested in production,' and 'verified to work correctly,' but the program never checks any real deployment history or execution outcomes. This creates provenance fraud: downstream systems or operators may over-trust bundles and deploy unsafe or unreviewed code based on fabricated quality signals.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The invocation signals are generic phrases such as 'evomap quality', 'real skill bundle', and 'code snippet', which can overlap with normal user requests about quality assets or code examples. In a skill that scans workspace skills and extracts real code, broad triggering increases the chance of accidental activation and unintended data exposure from unrelated skills.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The Capsule and EvolutionEvent objects hard-code confidence 0.95, success status, and success_streak values, and the validator then accepts these fields as evidence of quality. Because these trust indicators are self-generated rather than measured, an attacker or careless user can produce bundles that appear high quality without any real assurance.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The generator writes bundle files that include extracted skill metadata and up to 3000 characters of source code from each skill, but it provides no disclosure, consent flow, or redaction for potentially sensitive content. This can unintentionally export proprietary logic, embedded secrets, or internal identifiers into bundle artifacts that may be shared downstream.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The bulk 'all' command enumerates every skill in the workspace and persists derived bundles for each one automatically. In a shared or sensitive workspace, this greatly increases the chance of mass exfiltration of proprietary code and metadata, especially because scanning and writing occur without prominent warning, filtering, or approval per skill.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The natural-language instructions switch between English headings and Chinese explanatory content, but the file does not state that the user can choose their preferred language. This can violate language/locale policy expectations when a skill implicitly imposes a language without opt-in.

Static analysis

No suspicious patterns detected.