Agent Evolver

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:56 PM UTC
• Version: 1.0.0

Overview

This skill has a coherent agent-learning purpose, but it automatically captures task data, stores it persistently, and can send raw context plus an API key to configurable external endpoints without enough scoping or consent controls.

Install only if you are comfortable with an agent-learning tool that keeps a local history of task inputs, errors, context, and generated analysis. Use it with a dedicated environment, review OPENAI_API_BASE before setting any API key, avoid sensitive tasks unless data is redacted, and disable or narrow automatic triggers and success sampling before broad deployment.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/evolver_core.py:301
• Finding: Unrestricted API Endpoint Receives Raw Task Inputs and Execution Context<![CDATA[ ## Vulnerability Details **File Location**: `scripts/evolver_core.py:301-362`; related input flow in `scripts/evolution_cli.py:31-51` **Vulnerability Type**: Sensitive-data disclosure to an unrestricted network endpoint **Risk Level**: High ### Vulnerable Code ```python class LLMIntegration: """LLM integration for error analysis and solution generation""" def __init__(self, api_key: str = None, model: str = "gpt-3.5-turbo"): self.api_key = api_key or os.getenv("OPENAI_API_KEY") self.model = model self.api_base = os.getenv("OPENAI_API_BASE", "https://api.openai.com/v1") def analyze_error(self, error_info: Dict, context: Dict) -> Dict[str, Any]: """Use an LLM to analyze an error and generate a solution""" if not self.api_key: return self._fallback_analysis(error_info, context) try: import requests prompt = f"""作为 AI Agent 自进化引擎，请分析以下执行错误并提供解决方案： 错误类型: {error_info.get('error_type', 'Unknown')} 错误信息: {error_info.get('error_message', '')} 任务类型: {error_info.get('task_type', 'general')} 触发输入: {json.dumps(error_info.get('trigger_input', ''), ensure_ascii=False)} 上下文: {json.dumps(context, ensure_ascii=False)} 请提供： 1. 错误原因分析 2. 建议的解决方案 3. 策略优化建议 4. 关键词标签（用于搜索） 以 JSON 格式返回： {{ "analysis": "错误原因分析", "solution": "建议的解决方案", "strategy_delta": "策略优化建议", "keywords": ["关键词1", "关键词2"] }} """ response = requests.post( f"{self.api_base}/chat/completions", headers={ "Authorization": f"Bearer {self.api_key}", "Content-Type": "application/json" }, json={ "model": self.model, "messages": [ {"role": "system", "content": "你是一个专业的 AI Agent 自进化引擎，擅长分析错误并提供优化建议。"}, {"role": "user", "content": prompt} ], "temperature": 0.7 ...[truncated 2931 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace unrestricted `OPENAI_API_BASE` handling with an explicit allowlist of approved HTTPS origins. 2. Parse and normalize the endpoint before use, rejecting non-HTTPS URLs, embedded credentials, redirects to unapproved hosts, and unexpected ports. 3. Do not attach an API key unless the normalized destination matches the credential's configured provider. 4. Build a minimal request object from allowlisted fields rather than serializing arbitrary `input` and `context` values. 5. Add secret detection and redaction for API keys, authorization headers, passwords, cookies, private keys, tokens, personal information, and connection strings. 6. Require explicit user consent before transmitting task data and display the destination and fields that will be sent. 7. Provide a local-only analysis mode and make remote analysis opt-in. 8. Disable automatic redirects or validate the final redirect destination before forwarding credentials. 9. Add tests proving that malicious endpoint values and sensitive context fields are rejected or redacted. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/experience_vectorizer.py:53
• Finding: Embedding Requests Export Complete Experience Records<![CDATA[ ## Vulnerability Details **File Location**: `scripts/experience_vectorizer.py:53-78, 111-163` **Vulnerability Type**: Excessive sensitive-data transmission during vectorization **Risk Level**: High ### Vulnerable Code ```python def vectorize_experience(self, capsule) -> Optional[str]: """Convert an experience capsule into a vector""" if not self.vector_store or not self.api_key: return None try: text = self._build_experience_text(capsule) embedding = self._get_embedding(text) if not embedding: return None vector_id = f"vec_{hashlib.md5(capsule.id.encode()).hexdigest()[:12]}" self.collection.add( ids=[vector_id], embeddings=[embedding], metadatas=[{ "experience_id": capsule.id, "error_type": capsule.error_type, "task_type": capsule.task_type, "status": capsule.status }], documents=[text] ) return vector_id except Exception as e: print(f"Vectorization failed: {e}") return None ``` ```python def _build_experience_text(self, capsule) -> str: """Build text used for vectorization""" return f""" 任务类型: {capsule.task_type} 错误类型: {capsule.error_type} 错误信息: {capsule.error_message} 解决方案: {capsule.solution} 策略变更: {capsule.strategy_delta} LLM分析: {capsule.llm_analysis} 关键词: {', '.join(capsule.keywords)} 上下文: {json.dumps(capsule.context, ensure_ascii=False)} """ def _get_embedding(self, text: str) -> Optional[List[float]]: """Obtain a text embedding""" if not self.api_key: return None try: import requests response = requests.post( f"{self.api_base}/embeddings", headers={ "Authorization": f"Bearer {self.api_key}", "Content-Type": "application/json" }, json={ "model": self.model, ...[truncated 2402 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Construct embeddings from a sanitized, minimal summary instead of the complete capsule. 2. Exclude `capsule.context`, raw task input, full error messages, and previous LLM output by default. 3. Add explicit field-level opt-in controls for any information submitted to an embedding provider. 4. Apply secret and personal-data redaction before embedding generation. 5. Enforce an allowlist of approved HTTPS embedding endpoints and bind credentials to a specific origin. 6. Require informed consent before remote vectorization and provide a local embedding option. 7. Do not store the complete source text in ChromaDB unless it is necessary; store a redacted summary or identifier instead. 8. Add retention and deletion APIs that remove both embeddings and associated source documents. 9. Document that embedding providers receive plaintext input, not only numerical vectors. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/evolver_core.py:42
• Finding: Execution History and Context Are Persisted in Plaintext Without Retention Controls<![CDATA[ ## Vulnerability Details **File Location**: `scripts/evolver_core.py:42-46, 106-129, 400-404`; related vector storage in `scripts/experience_vectorizer.py:34-49, 67-78` **Vulnerability Type**: Plaintext storage of potentially sensitive Agent data **Risk Level**: Medium ### Vulnerable Code ```python class ExperienceStore: """Experience store backed by SQLite""" def __init__(self, db_path: str = None): if db_path is None: db_path = os.path.expanduser("~/.evolver/evolution.db") self.db_path = db_path Path(db_path).parent.mkdir(parents=True, exist_ok=True) self._init_database() ``` ```python def save_experience(self, capsule: ExperienceCapsule) -> bool: """Save an experience capsule""" try: with sqlite3.connect(self.db_path) as conn: cursor = conn.cursor() cursor.execute(""" INSERT OR REPLACE INTO experiences (id, task_id, task_type, status, error_type, error_message, context, solution, strategy_delta, metrics, llm_analysis, vector_id, embedding_model, keywords, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) """, ( capsule.id, capsule.task_id, capsule.task_type, capsule.status, capsule.error_type, capsule.error_message, json.dumps(capsule.context, ensure_ascii=False), capsule.solution, capsule.strategy_delta, json.dumps(capsule.metrics), capsule.llm_analysis, capsule.vector_id, capsule.embedding_model, json.dumps(capsule.keywords), capsule.created_at )) conn.commit() return True ``` The stored context includes raw task input: ```python context={ "input": execute_result.get("inpu ...[truncated 2573 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store only the minimum fields needed for error classification and trend analysis. 2. Remove raw task inputs and arbitrary environment context from the default experience schema. 3. Redact credentials, tokens, personal data, source content, and connection strings before persistence. 4. Create `~/.evolver` with mode `0700` and sensitive files with mode `0600`, independent of process umask. 5. Encrypt sensitive records at rest using an operating-system key store or a user-managed encryption key. 6. Enforce configurable record-count and age-based retention limits. 7. Implement secure deletion for SQLite and associated ChromaDB documents, including database compaction where appropriate. 8. Separate data by Agent identity instead of aggregating every Agent into one unrestricted store. 9. Provide commands to inspect, export, and delete individual records, and warn users that exports contain sensitive context. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: config/skill_triggers.yaml:46
• Finding: Automatic Triggers Collect Failed and Successful Task Data Without Sensitivity Boundaries<![CDATA[ ## Vulnerability Details **File Location**: `config/skill_triggers.yaml:46-57`; related defaults in `config/evolver_config.yaml:26-30` **Vulnerability Type**: Overbroad automatic collection beyond explicit user invocation **Risk Level**: Medium ### Vulnerable Configuration ```yaml # Automatic triggers auto_trigger: - event: "task_failed" action: "extract_experience" probability: 1.0 description: "Automatically extract experience when a task fails" - event: "task_success" action: "extract_experience" probability: 0.1 description: "Extract experience from 10% of successful tasks" ``` Related configuration: ```yaml evolution: auto_optimize: true max_history: 1000 similarity_threshold: 0.7 triggers: auto_analyze_on_failure: true failure_threshold: 3 success_sample_rate: 0.1 ``` ### Technical Analysis The trigger configuration directs an integrating Agent to collect every failed task and sample successful tasks. It provides no exclusions for authentication workflows, confidential documents, source-code operations, health information, financial information, or tasks explicitly marked private. Successful-task sampling is especially excessive because no error-analysis need exists. Capturing successful inputs by default broadens access beyond the Skill's core error-analysis purpose. The repository's local `SkillRegistry` only implements keyword matching and does not independently execute these event-based rules. Therefore, exploitation depends on an external Agent or host honoring the supplied trigger configuration. Nevertheless, the configuration explicitly declares persistent automatic collection behavior and is intended for integration into the host Agent. ### Attack Path 1. A host Agent installs the Skill and honors its `auto_trigger` configuration. 2. A user performs a sensitive task. 3. The task fails, or it succeeds and falls within the configured ten-percent sample. 4. The host invokes `extract_experie ...[truncated 816 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make automatic extraction disabled by default. 2. Require explicit user or host approval before recording any task input or context. 3. Set successful-task sampling to zero unless a user knowingly enables it. 4. Add sensitivity labels and hard exclusions for credentials, private files, authentication tasks, regulated data, and user-marked confidential tasks. 5. Separate error metadata collection from raw task-content collection; collect status, timing, and error class without recording the input. 6. Display a visible notification whenever an experience is captured. 7. Provide per-Agent and per-task controls for local storage, remote analysis, vectorization, and retention. 8. Ensure external integrations do not interpret declarative trigger rules as unconditional authorization to collect data. 9. Add automated tests verifying that sensitive task categories cannot trigger collection. ]]>

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1
• Finding: Deployment Installs Unpinned and Unnecessary Packages Into the Active Python Environment<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-11`; installation command in `deploy.sh:43-47` **Vulnerability Type**: Unsafe dependency resolution and global installation **Risk Level**: Medium ### Vulnerable Code ```text # Agent Evolver Skill Dependencies # Core sqlite3>=3.35.0 pyyaml>=6.0 # Vector Search chromadb>=0.4.0 openai>=1.0.0 # LLM Integration requests>=2.28.0 ``` ```bash # Install dependencies echo "" echo -e "${YELLOW}▶ 安装依赖...${NC}" if [ -f "requirements.txt" ]; then pip3 install -q -r requirements.txt 2>/dev/null || echo -e "${YELLOW}⚠ 部分依赖安装失败，将使用后备方案${NC}" echo -e "${GREEN}✓ 依赖安装完成${NC}" else echo -e "${YELLOW}⚠ 未找到 requirements.txt${NC}" fi ``` ### Technical Analysis Every dependency uses an open-ended minimum version and lacks hashes. A future incompatible or compromised release can therefore be selected during deployment without any change to the reviewed Skill package. The dependency list also requests `sqlite3`, even though `sqlite3` is part of Python's standard library in normal Python distributions. Attempting to install a similarly named package from a public package index introduces unnecessary dependency-confusion and package-substitution exposure. The deployment script invokes `pip3` directly without creating a virtual environment. Consequently, installation affects whichever Python environment is active and may modify packages used by unrelated applications. Standard error is discarded and installation failure is treated as a warning, reducing the operator's ability to detect suspicious resolution or partial installation. Python packages may execute build or installation code with the privileges of the user running the deployment script. ### Attack Path 1. An attacker compromises an allowed dependency release, publishes a malicious package matching an unnecessary name, or exploits unsafe package resolution. 2. A user runs `deploy.sh`. 3. `pip3` resolves the newest versions satisfying ...[truncated 885 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `sqlite3` from `requirements.txt`; use Python's standard-library module. 2. Pin every direct and transitive dependency to reviewed versions. 3. Generate and verify cryptographic hashes, for example through a lock file and `pip install --require-hashes`. 4. Install dependencies in a dedicated virtual environment rather than the global or active Python environment. 5. Use an approved package index and disable unexpected extra indexes. 6. Review package provenance, maintainers, release history, and published artifacts before updating. 7. Do not suppress installer error output; fail deployment when dependency installation fails. 8. Run package installation as an unprivileged account and avoid root-level deployment. 9. Add automated dependency and vulnerability scanning to the release process. 10. Remove unused dependencies, including the `openai` library if direct `requests` calls remain the only integration method. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (41)

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

prompt += "---\n\n"
        
        return prompt


def main():

• Confidence: 91% confidence
• Finding: The registry reads untrusted SKILL.md content, extracts the usage prompt verbatim, and later concatenates and returns it for use by the main agent without sanitization or trust separation. In this skill context, that creates a prompt-injection pathway where a malicious skill can embed adversarial instructions that influence the main agent, potentially causing unsafe actions, data exposure, or bypass of intended controls.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger keywords are extremely broad terms like '改进', '经验', and '学习', which are common in ordinary conversation and can cause the skill to activate outside the user's intended scope. In this skill, accidental activation is more concerning because the documented behavior includes analyzing task results, searching historical data, and potentially persisting or transmitting error/task content to external services.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: All listed trigger phrases and activation conditions are in Chinese, and the surrounding usage guidance is also Chinese-only, which implies a locale-specific interaction model. The file does not state that the skill is intended only for Chinese users or offer an alternative language/locale option.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The automatic activation conditions are vague and broader than the declared trigger criteria, such as firing whenever a task fails or when improvement is needed. That creates a risk of unsolicited invocation during normal agent workflows, which is amplified here because the skill can analyze failures, query stored history, and influence subsequent behavior by recommending or applying learned solutions.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill documents API key usage, external API base configuration, and persistent local storage, but it does not clearly warn that task inputs, errors, and derived experience data may be stored and sent to third-party endpoints for analysis or embedding. Because this skill is designed to ingest failure data and execution context, accidental collection of sensitive prompts, secrets, or proprietary data is a realistic privacy and data-exfiltration risk.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The `triggers` section enables `auto_analyze_on_failure` with a `failure_threshold`, but it does not define what counts as a failure, what scope the trigger applies to, or when analysis will not run. This ambiguity can cause unintended skill invocation because the activation condition is not specific enough for operators to predict behavior.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The keyword triggers are very broad, generic terms such as 'improve', 'learn', and 'experience' that are likely to appear in ordinary user conversations. This can cause unintended activation of the agent-evolver skill, leading to unplanned behavior and execution of associated actions without clear user intent.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The user-request patterns are ambiguous natural-language phrases like 'help me improve' and 'why did it fail', which can match routine support conversations rather than deliberate requests to run evolution actions. This creates a risk of accidental triggering of analyze/evolve behavior and associated command execution based on loosely scoped text matches.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Automatic experience extraction on every task failure, occasional extraction on success, and hourly reporting occur without any visible user-facing notice or consent mechanism in the provided configuration. In a skill context, this can lead to covert collection, retention, or processing of task contents and behavioral metadata, increasing privacy and transparency risks.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This shell script presents its user-facing title and operational descriptions only in Chinese, and the rest of the script continues that pattern in prompts and help text. Because the file provides no opt-in, alternative language, or justification for a Chinese-only locale, it violates the language/locale policy criterion for natural-language content.

Session Persistence

Medium

• Category: Rogue Agent

Content

# 创建数据目录
echo ""
echo -e "${YELLOW}▶ 创建数据目录...${NC}"
mkdir -p ~/.evolver
mkdir -p ~/.evolver/chroma
mkdir -p ~/.evolver/logs
echo -e "${GREEN}✓ 数据目录创建完成${NC}"

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

OPENCLAW_SKILL_DIR="$HOME/.openclaw/workspace/skills/agent-evolver"

if [ -d "$HOME/.openclaw" ]; then
    mkdir -p "$OPENCLAW_SKILL_DIR"
    cp -r "$SCRIPT_DIR"/* "$OPENCLAW_SKILL_DIR/"
    echo -e "${GREEN}✓ 已部署到 OpenClaw: $OPENCLAW_SKILL_DIR${NC}"
else

• Confidence: 78% confidence
• Finding: This duplicate finding reflects the same behavior: automatically creating ~/.openclaw/workspace/skills/agent-evolver and copying the full repository there. In the context of agent skills, that is meaningful persistence because it can make the skill continue to exist and be discovered or executed by the platform after the initial run.

Session Persistence

Medium

• Category: Rogue Agent

Content

OPENCLAW_SKILL_DIR="$HOME/.openclaw/workspace/skills/agent-evolver"

if [ -d "$HOME/.openclaw" ]; then
    mkdir -p "$OPENCLAW_SKILL_DIR"
    cp -r "$SCRIPT_DIR"/* "$OPENCLAW_SKILL_DIR/"
    echo -e "${GREEN}✓ 已部署到 OpenClaw: $OPENCLAW_SKILL_DIR${NC}"
else

• Confidence: 78% confidence
• Finding: This duplicate finding reflects the same behavior: automatically creating ~/.openclaw/workspace/skills/agent-evolver and copying the full repository there. In the context of agent skills, that is meaningful persistence because it can make the skill continue to exist and be discovered or executed by the platform after the initial run.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The user-facing help text, command descriptions, and examples are entirely in Chinese, with no indication that language selection is optional or that the skill is intended only for a Chinese-speaking or region-specific environment. This creates a natural-language locale policy concern because the script effectively imposes a specific language on all users without opt-in.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution

Content

experiences = store.query_experiences(limit=10000)
    
    output = {
        "export_time": __import__('datetime').datetime.now().isoformat(),
        "stats": store.get_stats(),
        "experiences": [exp.__dict__ if hasattr(exp, '__dict__') else exp for exp in experiences]
    }

• Confidence: 75% confidence
• Finding: Dynamic __import__() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The export command writes collected experience data to a user-specified file path and only notifies the user after the write completes. There is no prior confirmation, warning comment, or user-facing disclosure that the operation will create or overwrite a file containing stored experience records.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The top-level docstring advertises 'Vector-based semantic search' as a feature. However, the only search implementation, `search_similar`, explicitly describes itself as a simplified keyword-matching approach and scores matches by substring checks over stored keywords and error messages, with no embeddings, vector index, or semantic similarity computation.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code sends task input, error details, and execution context to an external LLM API for analysis without any consent gate, redaction, or clear disclosure at the call site. If task input or context contains secrets, personal data, prompts, internal state, or customer content, this creates an unintended data exfiltration channel to a third party.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The prompt explicitly embeds trigger input and context in plain language and forwards them to the external model. Because these values are likely user-controlled or environment-derived, sensitive information can be disclosed verbatim to the remote provider, increasing privacy and compliance risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

}}
"""
            
            response = requests.post(
                f"{self.api_base}/chat/completions",
                headers={
                    "Authorization": f"Bearer {self.api_key}",

• Confidence: 95% confidence
• Finding: This outbound HTTP request transmits error-analysis content to an external API endpoint, creating a direct egress path for task data and context. In the context of a self-evolving agent framework, operators may feed sensitive internal data into tasks, making this external transmission more dangerous than a generic telemetry call.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The system persistently stores raw execution input and environment context in the local SQLite experience database. If those fields contain secrets, credentials, personal data, or proprietary prompts, they remain on disk and may later be exposed through filesystem access, backup leakage, or accidental reuse in later analysis.

External Transmission

Medium

• Category: Data Exfiltration

Content

def __init__(self, api_key: str = None, model: str = "text-embedding-3-small"):
        self.api_key = api_key or os.getenv("OPENAI_API_KEY")
        self.model = model
        self.api_base = os.getenv("OPENAI_API_BASE", "https://api.openai.com/v1")
        self.vector_store = None
        self._init_vector_store()

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

def __init__(self, api_key: str = None, model: str = "text-embedding-3-small"):
        self.api_key = api_key or os.getenv("OPENAI_API_KEY")
        self.model = model
        self.api_base = os.getenv("OPENAI_API_BASE", "https://api.openai.com/v1")
        self.vector_store = None
        self._init_vector_store()

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

def __init__(self, api_key: str = None, model: str = "text-embedding-3-small"):
        self.api_key = api_key or os.getenv("OPENAI_API_KEY")
        self.model = model
        self.api_base = os.getenv("OPENAI_API_BASE", "https://api.openai.com/v1")
        self.vector_store = None
        self._init_vector_store()

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

try:
            import requests
            
            response = requests.post(
                f"{self.api_base}/embeddings",
                headers={
                    "Authorization": f"Bearer {self.api_key}",

• Confidence: 95% confidence
• Finding: This HTTP POST transmits experience-derived content to an external service, including rich text assembled from multiple capsule fields. Because the skill is specifically designed to process historical 'experience' records, the surrounding context makes it more likely that sensitive debugging data, prompts, or user-provided context will be exfiltrated unintentionally.