EvoAgentX Workflow

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:21 PM UTC
• Version: 1.0.2

Overview

This skill is not clearly malicious, but it overstates its EvoAgentX/OpenClaw capabilities and includes unsafe workflow-file generation that can overwrite files or create injectable Python code.

Review this skill before installing. Use it only in a disposable or dedicated environment, pin and verify the EvoAgentX dependency yourself, and avoid passing untrusted workflow names or descriptions to the CLI. Treat the generated workflow files as code that must be reviewed before running or importing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9
• Finding: Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:9-18`, with matching installation guidance at `SKILL.md:62-69` and `scripts/evoagentx_cli.py:42-50` **Vulnerability Type**: Unpinned package installation and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```yaml "install": [ { "id": "pip", "kind": "pip", "package": "evoagentx", "bins": ["python3"], "label": "Install EvoAgentX framework", }, ], ``` The same unpinned installation is presented to users: ```bash pip install evoagentx ``` ### Technical Analysis The skill installs `evoagentx` without constraining its version or validating package integrity. Consequently, the code installed by this skill is not fixed to the version that existed when the skill was audited. The resolved package and its transitive dependencies may change between installations. Python packages can run code during installation, import, and normal execution. If the upstream project, its package-publishing account, or one of its dependencies is compromised, a later package release could execute attacker-controlled code under the account performing the installation. No lockfile, package hash, reviewed version, or isolated installation environment is specified. The repository does not itself retrieve and execute a remote script, but it delegates executable behavior to a mutable package source through `pip`. ### Attack Path 1. An attacker compromises the upstream package, its publishing credentials, or a transitive dependency. 2. The attacker publishes a malicious release that still satisfies the unconstrained package name `evoagentx`. 3. A user installs the skill or follows its documented `pip install evoagentx` command. 4. `pip` resolves the attacker-controlled release because no reviewed version or hash is required. 5. Malicious code runs during installation, import, or subsequent EvoAgentX use with the privileges of the installing user. ### Impact Assessment Successful explo ...[truncated 533 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `evoagentx` to a specific reviewed version rather than installing the latest available release. 2. Maintain a lockfile containing exact versions for all transitive dependencies. 3. Require cryptographic package hashes, such as through `pip install --require-hashes -r requirements.txt`. 4. Verify that the package is obtained from the intended package index and document the trusted publisher and source repository. 5. Install the dependency in a dedicated virtual environment with minimum filesystem and credential access. 6. Add dependency vulnerability and provenance checks to the release process. 7. Review and deliberately update the pinned version rather than accepting automatic package changes. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/evoagentx_cli.py:74
• Finding: Unsanitized Workflow Name and Description Permit Path Traversal and Generated-Code Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/evoagentx_cli.py:74-146` **Vulnerability Type**: Path traversal, arbitrary file overwrite, and Python source injection **Risk Level**: High ### Vulnerable Code The generated Python template directly embeds the supplied workflow name and description: ```python template = '''""" {workflow_name}.py - EvoAgentX Workflow Generated by evoagentx-workflow skill """ from evoagentx import Workflow, Agent class {workflow_name}(Workflow): """ {description} """ async def execute(self, context): """ Main workflow execution Args: context: Execution context with inputs Returns: Workflow result """ # Step 1: Initialize self.log("Starting workflow...") # Step 2: Execute core logic # TODO: Add your workflow logic here result = await self.process(context) # Step 3: Return results return {{ "status": "success", "result": result }} async def process(self, context): """Core processing logic""" # Implement your specific logic pass # For standalone testing if __name__ == "__main__": import asyncio workflow = {workflow_name}() result = asyncio.run(workflow.execute({{}})) print(result) ''' ``` The unvalidated values are then used as source text and as an output path: ```python workflow_name = args.name or "MyWorkflow" description = args.description or "A self-evolving agent workflow" filename = f"{workflow_name.lower()}.py" content = template.format( workflow_name=workflow_name, description=description ) with open(filename, 'w') as f: f.write(content) ``` ### Technical Analysis The `--name` value crosses two security-sensitive boundaries without validation: 1. It is used to construct `filename`, allowing path separators and `..` component ...[truncated 2909 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate workflow names as Python identifiers using a strict rule such as: ```python import re if not re.fullmatch(r"[A-Za-z_][A-Za-z0-9_]*", args.name): raise ValueError("Workflow name must be a valid Python identifier") ``` 2. Select an explicit output directory, resolve both it and the destination to canonical paths, and reject destinations outside that directory: ```python output_dir = Path(args.output_dir).resolve() destination = (output_dir / f"{workflow_name.lower()}.py").resolve() if output_dir not in destination.parents: raise ValueError("Output path escapes the selected directory") ``` 3. Do not treat the class name as a path. Keep the validated Python identifier separate from any filename supplied by the user. 4. Escape the description as a Python string literal, for example by generating an assignment with `repr(description)`, rather than interpolating it inside a triple-quoted string. 5. Prefer an AST-based or established templating approach that keeps user-provided text in string-literal nodes rather than executable source contexts. 6. Refuse to overwrite existing files by default. Use exclusive creation mode (`x`) or require an explicit `--force` option after displaying the resolved destination. 7. Add tests covering `..`, absolute paths, path separators, quotes, triple quotes, newlines, braces, invalid identifiers, and existing destination files. 8. If arguments may originate from an agent or external workflow definition, treat them as untrusted input and require explicit user approval of the resolved output path before writing. ]]>

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill materially overstates its functionality, claiming OpenClaw integration, evolutionary optimization features, and concrete EvoAgentX bridging that are not actually implemented. This is dangerous because users or higher-level agents may trust the skill to perform complex automation safely, install dependencies, or make workflow decisions based on nonexistent controls, causing unsafe delegation, supply-chain exposure, and operational misuse.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises and demonstrates capabilities that imply network access and file creation, but it declares no explicit tool scope or permissions. In an agent ecosystem, this weakens policy enforcement and reviewability, making it easier for the skill to perform higher-risk actions than users or the platform expect.

Static analysis

No suspicious patterns detected.