Security audit

evolution-predictor

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent, but it reads persistent OpenClaw evolution history by default without clearly disclosing that access in the skill instructions.

Review before installing. This skill does not appear to exfiltrate, modify, or persist data, but it can read OpenClaw evolution history files by default and use extracted signals, intents, and gene names to shape recommendations. Install only if you are comfortable granting it read access to that persistent agent history, or require an explicit approved history path and clearer documentation first.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: index.js:26
Finding: Implicit Access to Persistent Agent Evolution Memory
Content: View full analysis
f.startsWith('gep_prompt_Cycle_') && f.endsWith('.txt')) .sort() .reverse() .slice(0, historyLimit); const signalCounts = {}; const intentCounts = {}; const geneCounts = {}; const recentOutcomes = []; for (const file of files) { const filePath = path.join(evolutionPath, file); const content = fs.readFileSync(filePath, 'utf8'); ``` ### Technical Analysis Calling `predictNextAction()` without options automatically selects the absolute directory `/root/.openclaw/workspace/memory/evolution`. The function enumerates this persistent Agent-memory directory and reads the complete contents of matching historical prompt files before extracting signals, intents, selected gene names, and outcomes. The documented purpose refers generally to history analysis, but it does not clearly identify the sensitive absolute directory being accessed or require explicit authorization from the caller. Consequently, normal invocation of the public API crosses the skill package boundary and reads persistent Agent state by default. Th ...[truncated 2160 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
md
### `explore_new_domains` (Medium) When success rate > 90% - Expand capabilities - Add integrations - Improve user experience

Static analysis

No suspicious patterns detected.