ClawHub
Back to skill

Security audit

Agent Evolver

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent agent-learning purpose, but it automatically captures task data, stores it persistently, and can send raw context plus an API key to configurable external endpoints without enough scoping or consent controls.

Install only if you are comfortable with an agent-learning tool that keeps a local history of task inputs, errors, context, and generated analysis. Use it with a dedicated environment, review OPENAI_API_BASE before setting any API key, avoid sensitive tasks unless data is redacted, and disable or narrow automatic triggers and success sampling before broad deployment.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/evolver_core.py:301
Finding

Unrestricted API Endpoint Receives Raw Task Inputs and Execution Context

Content
View full analysis
Dict[str, Any]: """Use an LLM to analyze an error and generate a solution""" if not self.api_key: return self._fallback_analysis(error_info, context) try: import requests prompt = f"""作为 AI Agent 自进化引擎，请分析以下执行错误并提供解决方案： 错误类型: {error_info.get('error_type', 'Unknown')} 错误信息: {error_info.get('error_message', '')} 任务类型: {error_info.get('task_type', 'general')} 触发输入: {json.dumps(error_info.get('trigger_input', ''), ensure_ascii=False)} 上下文: {json.dumps(context, ensure_ascii=False)} 请提供： 1. 错误原因分析 2. 建议的解决方案 3. 策略优化建议 4. 关键词标签（用于搜索） 以 JSON 格式返回： {{ "analysis": "错误原因分析", "solution": "建议的解决方案", "strategy_delta": "策略优化建议", "keywords": ["关键词1", "关键词2"] }} """ response = requests.post( f"{self.api_base}/chat/completions", headers={ "Authorization": f"Bearer {self.api_key}", "Content-Type": "application/json" }, json={ "model": self.model, "messages": [ {"role": "system", "content": "你是一个专业的 AI Agent 自进化引擎，擅长分析错误并提供优化建议。"}, {"role": "user", "content": prompt} ], "temperature": 0.7 ...[truncated 2931 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/experience_vectorizer.py:53
Finding

Embedding Requests Export Complete Experience Records

Content
View full analysis
Optional[str]: """Convert an experience capsule into a vector""" if not self.vector_store or not self.api_key: return None try: text = self._build_experience_text(capsule) embedding = self._get_embedding(text) if not embedding: return None vector_id = f"vec_{hashlib.md5(capsule.id.encode()).hexdigest()[:12]}" self.collection.add( ids=[vector_id], embeddings=[embedding], metadatas=[{ "experience_id": capsule.id, "error_type": capsule.error_type, "task_type": capsule.task_type, "status": capsule.status }], documents=[text] ) return vector_id except Exception as e: print(f"Vectorization failed: {e}") return None ``` ```python def _build_experience_text(self, capsule) -> str: """Build text used for vectorization""" return f""" 任务类型: {capsule.task_type} 错误类型: {capsule.error_type} 错误信息: {capsule.error_message} 解决方案: {capsule.solution} 策略变更: {capsule.strategy_delta} LLM分析: {capsule.llm_analysis} 关键词: {', '.join(capsule.keywords)} 上下文: {json.dumps(capsule.context, ensure_ascii=False)} """ def _get_embedding(self, text: str) -> Optional[List[float]]: """Obtain a text embedding""" if not self.api_key: return None try: import requests response = requests.post( f"{self.api_base}/embeddings", headers={ "Authorization": f"Bearer {self.api_key}", "Content-Type": "application/json" }, json={ "model": self.model, ...[truncated 2402 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/evolver_core.py:42
Finding

Execution History and Context Are Persisted in Plaintext Without Retention Controls

Content
View full analysis
bool: """Save an experience capsule""" try: with sqlite3.connect(self.db_path) as conn: cursor = conn.cursor() cursor.execute(""" INSERT OR REPLACE INTO experiences (id, task_id, task_type, status, error_type, error_message, context, solution, strategy_delta, metrics, llm_analysis, vector_id, embedding_model, keywords, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) """, ( capsule.id, capsule.task_id, capsule.task_type, capsule.status, capsule.error_type, capsule.error_message, json.dumps(capsule.context, ensure_ascii=False), capsule.solution, capsule.strategy_delta, json.dumps(capsule.metrics), capsule.llm_analysis, capsule.vector_id, capsule.embedding_model, json.dumps(capsule.keywords), capsule.created_at )) conn.commit() return True ``` The stored context includes raw task input: ```python context={ "input": execute_result.get("inpu ...[truncated 2573 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
config/skill_triggers.yaml:46
Finding

Automatic Triggers Collect Failed and Successful Task Data Without Sensitivity Boundaries

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Deployment Installs Unpinned and Unnecessary Packages Into the Active Python Environment

Content
View full analysis
=3.35.0 pyyaml>=6.0 # Vector Search chromadb>=0.4.0 openai>=1.0.0 # LLM Integration requests>=2.28.0 ``` ```bash # Install dependencies echo "" echo -e "${YELLOW}▶ 安装依赖...${NC}" if [ -f "requirements.txt" ]; then pip3 install -q -r requirements.txt 2>/dev/null || echo -e "${YELLOW}⚠ 部分依赖安装失败，将使用后备方案${NC}" echo -e "${GREEN}✓ 依赖安装完成${NC}" else echo -e "${YELLOW}⚠ 未找到 requirements.txt${NC}" fi ``` ### Technical Analysis Every dependency uses an open-ended minimum version and lacks hashes. A future incompatible or compromised release can therefore be selected during deployment without any change to the reviewed Skill package. The dependency list also requests `sqlite3`, even though `sqlite3` is part of Python's standard library in normal Python distributions. Attempting to install a similarly named package from a public package index introduces unnecessary dependency-confusion and package-substitution exposure. The deployment script invokes `pip3` directly without creating a virtual environment. Consequently, installation affects whichever Python environment is active and may modify packages used by unrelated applications. Standard error is discarded and installation failure is treated as a warning, reducing the operator's ability to detect suspicious resolution or partial installation. Python packages may execute build or installation code with the privileges of the user running the deployment script. ### Attack Path 1. An attacker compromises an allowed dependency release, publishes a malicious package matching an unnecessary name, or exploits unsafe package resolution. 2. A user runs `deploy.sh`. 3. `pip3` resolves the newest versions satisfying ...[truncated 885 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (41)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
91% confidence
Finding

The registry reads untrusted SKILL.md content, extracts the usage prompt verbatim, and later concatenates and returns it for use by the main agent without sanitization or trust separation. In this skill context, that creates a prompt-injection pathway where a malicious skill can embed adversarial instructions that influence the main agent, potentially causing unsafe actions, data exposure, or bypass of intended controls.

Content

Scanner excerpt · scripts/skill_registry.py (reported line 226)May include surrounding context.

python
prompt += "---\n\n"
        
        return prompt


def main():

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger keywords are extremely broad terms like '改进', '经验', and '学习', which are common in ordinary conversation and can cause the skill to activate outside the user's intended scope. In this skill, accidental activation is more concerning because the documented behavior includes analyzing task results, searching historical data, and potentially persisting or transmitting error/task content to external services.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

All listed trigger phrases and activation conditions are in Chinese, and the surrounding usage guidance is also Chinese-only, which implies a locale-specific interaction model. The file does not state that the skill is intended only for Chinese users or offer an alternative language/locale option.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The automatic activation conditions are vague and broader than the declared trigger criteria, such as firing whenever a task fails or when improvement is needed. That creates a risk of unsolicited invocation during normal agent workflows, which is amplified here because the skill can analyze failures, query stored history, and influence subsequent behavior by recommending or applying learned solutions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill documents API key usage, external API base configuration, and persistent local storage, but it does not clearly warn that task inputs, errors, and derived experience data may be stored and sent to third-party endpoints for analysis or embedding. Because this skill is designed to ingest failure data and execution context, accidental collection of sensitive prompts, secrets, or proprietary data is a realistic privacy and data-exfiltration risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The triggers section enables auto_analyze_on_failure with a failure_threshold, but it does not define what counts as a failure, what scope the trigger applies to, or when analysis will not run. This ambiguity can cause unintended skill invocation because the activation condition is not specific enough for operators to predict behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The keyword triggers are very broad, generic terms such as 'improve', 'learn', and 'experience' that are likely to appear in ordinary user conversations. This can cause unintended activation of the agent-evolver skill, leading to unplanned behavior and execution of associated actions without clear user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The user-request patterns are ambiguous natural-language phrases like 'help me improve' and 'why did it fail', which can match routine support conversations rather than deliberate requests to run evolution actions. This creates a risk of accidental triggering of analyze/evolve behavior and associated command execution based on loosely scoped text matches.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Automatic experience extraction on every task failure, occasional extraction on success, and hourly reporting occur without any visible user-facing notice or consent mechanism in the provided configuration. In a skill context, this can lead to covert collection, retention, or processing of task contents and behavioral metadata, increasing privacy and transparency risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This shell script presents its user-facing title and operational descriptions only in Chinese, and the rest of the script continues that pattern in prompts and help text. Because the file provides no opt-in, alternative language, or justification for a Chinese-only locale, it violates the language/locale policy criterion for natural-language content.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · deploy.sh (reported line 37)May include surrounding context.

sh
# 创建数据目录
echo ""
echo -e "${YELLOW}▶ 创建数据目录...${NC}"
mkdir -p ~/.evolver
mkdir -p ~/.evolver/chroma
mkdir -p ~/.evolver/logs
echo -e "${GREEN}✓ 数据目录创建完成${NC}"

Session Persistence

Medium
Category
Rogue Agent
Confidence
78% confidence
Finding

This duplicate finding reflects the same behavior: automatically creating ~/.openclaw/workspace/skills/agent-evolver and copying the full repository there. In the context of agent skills, that is meaningful persistence because it can make the skill continue to exist and be discovered or executed by the platform after the initial run.

Content

Scanner excerpt · deploy.sh (reported line 143)May include surrounding context.

sh
OPENCLAW_SKILL_DIR="$HOME/.openclaw/workspace/skills/agent-evolver"

if [ -d "$HOME/.openclaw" ]; then
    mkdir -p "$OPENCLAW_SKILL_DIR"
    cp -r "$SCRIPT_DIR"/* "$OPENCLAW_SKILL_DIR/"
    echo -e "${GREEN}✓ 已部署到 OpenClaw: $OPENCLAW_SKILL_DIR${NC}"
else

Session Persistence

Medium
Category
Rogue Agent
Confidence
78% confidence
Finding

This duplicate finding reflects the same behavior: automatically creating ~/.openclaw/workspace/skills/agent-evolver and copying the full repository there. In the context of agent skills, that is meaningful persistence because it can make the skill continue to exist and be discovered or executed by the platform after the initial run.

Content

Scanner excerpt · deploy.sh (reported line 143)May include surrounding context.

sh
OPENCLAW_SKILL_DIR="$HOME/.openclaw/workspace/skills/agent-evolver"

if [ -d "$HOME/.openclaw" ]; then
    mkdir -p "$OPENCLAW_SKILL_DIR"
    cp -r "$SCRIPT_DIR"/* "$OPENCLAW_SKILL_DIR/"
    echo -e "${GREEN}✓ 已部署到 OpenClaw: $OPENCLAW_SKILL_DIR${NC}"
else

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The user-facing help text, command descriptions, and examples are entirely in Chinese, with no indication that language selection is optional or that the skill is intended only for a Chinese-speaking or region-specific environment. This creates a natural-language locale policy concern because the script effectively imposes a specific language on all users without opt-in.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/evolution_cli.py (reported line 200)May include surrounding context.

python
experiences = store.query_experiences(limit=10000)
    
    output = {
        "export_time": __import__('datetime').datetime.now().isoformat(),
        "stats": store.get_stats(),
        "experiences": [exp.__dict__ if hasattr(exp, '__dict__') else exp for exp in experiences]
    }

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The export command writes collected experience data to a user-specified file path and only notifies the user after the write completes. There is no prior confirmation, warning comment, or user-facing disclosure that the operation will create or overwrite a file containing stored experience records.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The top-level docstring advertises 'Vector-based semantic search' as a feature. However, the only search implementation, search_similar, explicitly describes itself as a simplified keyword-matching approach and scores matches by substring checks over stored keywords and error messages, with no embeddings, vector index, or semantic similarity computation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code sends task input, error details, and execution context to an external LLM API for analysis without any consent gate, redaction, or clear disclosure at the call site. If task input or context contains secrets, personal data, prompts, internal state, or customer content, this creates an unintended data exfiltration channel to a third party.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The prompt explicitly embeds trigger input and context in plain language and forwards them to the external model. Because these values are likely user-controlled or environment-derived, sensitive information can be disclosed verbatim to the remote provider, increasing privacy and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This outbound HTTP request transmits error-analysis content to an external API endpoint, creating a direct egress path for task data and context. In the context of a self-evolving agent framework, operators may feed sensitive internal data into tasks, making this external transmission more dangerous than a generic telemetry call.

Content

Scanner excerpt · scripts/evolver_core.py (reported line 337)May include surrounding context.

python
}}
"""
            
            response = requests.post(
                f"{self.api_base}/chat/completions",
                headers={
                    "Authorization": f"Bearer {self.api_key}",

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The system persistently stores raw execution input and environment context in the local SQLite experience database. If those fields contain secrets, credentials, personal data, or proprietary prompts, they remain on disk and may later be exposed through filesystem access, backup leakage, or accidental reuse in later analysis.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · config/evolver_config.yaml (reported line 9)May include surrounding context.

yaml
def __init__(self, api_key: str = None, model: str = "text-embedding-3-small"):
        self.api_key = api_key or os.getenv("OPENAI_API_KEY")
        self.model = model
        self.api_base = os.getenv("OPENAI_API_BASE", "https://api.openai.com/v1")
        self.vector_store = None
        self._init_vector_store()

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/evolver_core.py (reported line 304)May include surrounding context.

python
def __init__(self, api_key: str = None, model: str = "text-embedding-3-small"):
        self.api_key = api_key or os.getenv("OPENAI_API_KEY")
        self.model = model
        self.api_base = os.getenv("OPENAI_API_BASE", "https://api.openai.com/v1")
        self.vector_store = None
        self._init_vector_store()

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/experience_vectorizer.py (reported line 28)May include surrounding context.

python
def __init__(self, api_key: str = None, model: str = "text-embedding-3-small"):
        self.api_key = api_key or os.getenv("OPENAI_API_KEY")
        self.model = model
        self.api_base = os.getenv("OPENAI_API_BASE", "https://api.openai.com/v1")
        self.vector_store = None
        self._init_vector_store()

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This HTTP POST transmits experience-derived content to an external service, including rich text assembled from multiple capsule fields. Because the skill is specifically designed to process historical 'experience' records, the surrounding context makes it more likely that sensitive debugging data, prompts, or user-provided context will be exfiltrated unintentionally.

Content

Scanner excerpt · scripts/experience_vectorizer.py (reported line 147)May include surrounding context.

python
try:
            import requests
            
            response = requests.post(
                f"{self.api_base}/embeddings",
                headers={
                    "Authorization": f"Bearer {self.api_key}",