ClawHub
Back to skill

Security audit

bacon

Security checks for vulnerabilities and agentic risk

Overview

This skill openly gives an agent authority to modify its own memory, skills, tool rules, and configuration, including some behavior-changing edits before explicit user approval.

Install only if you intentionally want an agent that can make persistent self-improvements. Consider requiring explicit approval for every change to skills, tool rules, configuration, memory, or active behavior, and verify that the bacon/self-evolve listing mismatch is expected before trusting it.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly allows immediate edits to behavior-defining files like `SKILLS.md` and `TOOLS.md` without prior user approval, only requiring logging and later notification. Even with backups and rollback, this creates a real authority-escalation path because an agent can change its own operational behavior before a human has a chance to review or stop the modification.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The description authorizes 'proactive improvement' and 'self-modifications' using broad language without concrete trigger conditions, scope limits, or explicit deny-by-default boundaries. Even though it mentions tiers, audit trails, and rollback, the metadata still advertises open-ended self-modification authority that could enable unsafe activation or policy drift when interpreted by an agent.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
{
  "name": "self-evolve",
  "version": "2.0.0",
  "description": "Controlled autonomous self-evolution with three-tier safety system. Tier 1: auto-approved (memory/logs). Tier 2: validated (skills, tools). Tier 3: oversight-required (core behavior, security). Mandatory backups, audit trails, and rollback capabilities for all self-modifications. Proactive improvement within verifiable boundaries.",
  "author": "cloudboy",
  "homepage": "https://clawhub.ai",
  "keywords": [
Confidence
84% confidence
Finding
The phrase 'Tier 1: auto-approved' grants autonomous decision-making authority for some modifications, which can normalize self-directed changes without external review. Although limited to 'memory/logs' in the description, the file does not define enforcement guarantees, validation criteria, or tamper-resistant separation, so an agent could over-interpret what qualifies for auto-approval.

Self-Modification

High
Category
Rogue Agent
Content
---
name: self-evolve
version: 2.0.0
description: >
  Controlled autonomous self-evolution: grants the agent authority to self-improve
Confidence
97% confidence
Finding
The skill's core purpose is to grant the agent authority to self-improve, which is inherently high risk because self-modification can alter future constraints, decision logic, or enforcement boundaries. Although framed as controlled and audited, any mechanism that authorizes autonomous self-change increases the chance of policy drift, unsafe capability expansion, or weakening of safeguards over time.

Self-Modification

High
Category
Rogue Agent
Content
through a tiered safety system with mandatory audit trails, rollback capabilities,
  and human oversight checkpoints for critical modifications.
author: cloudboy
keywords: [self-evolve, autonomous, self-improvement, controlled, audited, evolution]
---

# 🧬 Self-Evolve — Controlled Autonomy Protocol
Confidence
96% confidence
Finding
The metadata and description reinforce that this skill is designed for autonomous self-improvement. Even with stated oversight checkpoints, the existence of a formal self-evolution protocol normalizes agent-initiated behavior changes and increases the attack surface if the agent misclassifies a change, follows adversarial input, or edits files that influence future execution.

Self-Modification

High
Category
Rogue Agent
Content
keywords: [self-evolve, autonomous, self-improvement, controlled, audited, evolution]
---

# 🧬 Self-Evolve — Controlled Autonomy Protocol

## Principle: Trust with Verification
Confidence
96% confidence
Finding
The 'Self-Evolve' protocol is itself a self-modification framework, which is dangerous because it establishes a standing process for the agent to rewrite aspects of its operation. Context makes this more dangerous, not less, because the skill is specifically intended to institutionalize autonomous evolution rather than treating changes as rare, exceptional, human-controlled events.

Self-Modification

High
Category
Rogue Agent
Content
{
  "name": "self-evolve",
  "version": "2.0.0",
  "description": "Controlled autonomous self-evolution with three-tier safety system. Tier 1: auto-approved (memory/logs). Tier 2: validated (skills, tools). Tier 3: oversight-required (core behavior, security). Mandatory backups, audit trails, and rollback capabilities for all self-modifications. Proactive improvement within verifiable boundaries.",
  "author": "cloudboy",
Confidence
94% confidence
Finding
The skill name itself explicitly signals self-evolution/self-modification, which is a high-risk capability because it can let an agent alter its own behavior, tools, or constraints over time. In this context, the accompanying description confirms real self-modification authority rather than a purely descriptive label, making the capability materially dangerous despite mentions of safety tiers and rollback.

Static analysis

No suspicious patterns detected.