Back to skill

Security audit

Robot Evolve

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a local maintenance tool, but it has under-disclosed persistent state changes and misleading safe-mode entry points that users should review before installing.

Install only if you are comfortable with a skill that can modify persistent workspace memory and store selected session content. Before use, require confirmation for MEMORY.md compression and knowledge-card generation, avoid relying on --dry-run or health_checker.py as read-only safeguards, and back up MEMORY.md first.

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/auto_evolve.py:95
Finding

Destructive Memory Rewriting Without Backup or Transactional Recovery

Content
View full analysis
由 robot-evolve 自动压缩生成 | {datetime.now().strftime('%Y-%m-%d')} ## 原始大小 - 压缩前: {size/1024/1024:.2f}MB - 行数: {total_lines} 行 ## 早期内容摘要 (详细历史请查看 `memory/evolution/` 中的归档日志) --- """ # 写入新内容 with open(memory_file, "w", encoding="utf-8") as f: f.write(summary + recent_content) new_size = memory_file.stat().st_size result = [ f"✅ MEMORY.md 已压缩(从 {size/1024/1024:.2f}MB 减少至 {new_size/1024/1024:.2f}MB)", f"✅ 保留最近 {int(total_lines * 0.8)} 行内容" ] log_action("记忆压缩", f"MEMORY.md从{size/1024/1024:.2f}MB压缩至{new_size/1024/1024:.2f}MB", "L1") return result ``` ### Technical Analysis The operation is described as compression and summarization, but it does not summarize or archive the removed material. It calculates a position at 20% of the file, retains only the rem ...[truncated 1493 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/auto_evolve.py:304
Finding

Documented Dry-Run Mode Executes the Full Mutating Workflow

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/health_checker.py:14
Finding

Health-Check Entry Point Executes Destructive Evolution Operations

Content
View full analysis
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
scripts/knowledge_manager.py:51
Finding

Session Content Is Persisted as Long-Term Knowledge Without Explicit Consent or Trust Validation

Content
View full analysis
10: knowledge_items.append({ "content": line.strip(), "topic": "对话记录", "created_at": datetime.now().strftime("%Y-%m-%d"), "version": "1" }) return knowledge_items[:10] # 最多取10条 except Exception as e: print(f"提取知识失败: {e}") return [] ``` ```python def add_knowledge(client, topic, content, version="1", supersedes=None): """添加知识到向量库""" collection = get_or_create_collection(client) metadata = { "topic": topic, "version": version, "created_at": datetime.now().strftime("%Y-%m-%d"), "type": "knowledge_card" } if supersedes: metadata["supersedes"] = supersedes collection.add( documents=[content], metadatas=[metadata], ids=[f"kb_{datetime.now().strftime('%Y%m%d%H%M%S')}"] ) # 同时保存到文件库 LIBRARY_DIR.mkdir(parents=True, exist_ok=True) kb_file = LIBRARY_DIR / f"{datetime.now().strftime('%Y%m%d')}_{topic.replace(' ', '_')}.md" with open(kb_ ...[truncated 3207 chars]
Remediation
View remediation
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (24)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
| 技能目录扫描 | 扫描已安装技能,发现 `SKILL.md` 格式明显错误(如缺少名称字段)则标记并记录日志 |

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · safety-matrix.json (reported line 108)May include surrounding context.

json
"id": "6",
      "name": "文件系统(工作区外)",
      "rules": [
        {"id": "6.1", "operation": "读取工作区外的公开文件(如 /etc/passwd)", "level": "L2", "note": "可能涉及敏感信息"},
        {"id": "6.2", "operation": "读取用户个人文档(桌面、文档目录)", "level": "L2", "note": "除非用户明确授权"},
        {"id": "6.3", "operation": "在工作区外创建新文件", "level": "L2", "note": "例如桌面上的临时文件"},
        {"id": "6.4", "operation": "修改或删除工作区外的任何文件", "level": "L3", "note": "用户数据红线"},

Credential Access

High
Category
Privilege Escalation
Confidence
92% confidence
Finding

The policy explicitly allows storing user-provided API keys in '.env' or 'openclaw.json', and marks some key storage as L0/L1, which normalizes credential handling without requiring stronger controls such as secret isolation, encryption, redaction, or least-privilege storage. In a skill context, this is dangerous because skills often operate in shared workspaces where plaintext secrets can be read, committed, logged, or modified by other components.

Content

Scanner excerpt · safety-matrix.json (reported line 120)May include surrounding context.

json
"name": "API 密钥与环境变量",
      "rules": [
        {"id": "7.1", "operation": "读取已有的环境变量(os.getenv)", "level": "L0", "note": "仅用于技能调用"},
        {"id": "7.2", "operation": "存储用户明确提供的 API 密钥(非付费)", "level": "L0", "note": "存放位置:.env 或 openclaw.json 的 env 字段"},
        {"id": "7.3", "operation": "存储用户明确提供的付费 API 密钥", "level": "L1", "note": "如 OpenAI;提醒用户确认密钥来源可信,且不要在聊天中直接发送完整密钥"},
        {"id": "7.4", "operation": "删除或覆盖已有的 API 密钥", "level": "L2", "note": "可能导致技能失效"},
        {"id": "7.5", "operation": "将 API 密钥输出到聊天或日志", "level": "L3", "note": "绝对红线"},

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script advertises a '--dry-run' mode that should avoid modifications, but the flag only changes console output and does not prevent mutating functions from running. A user or higher-level agent relying on dry-run safety could unintentionally trigger file writes, file moves, and state changes in the workspace, which is a dangerous integrity violation.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
92% confidence
Finding

The skill explicitly markets ‘self-evolve’ and ‘auto-evolve’ behavior, which strongly suggests self-modification or autonomous capability expansion. In an agent context, self-modification is especially dangerous because it can bypass review assumptions, alter behavior over time, and potentially introduce unauthorized code, prompt, or configuration changes.

Content

Scanner excerpt · skill.json (reported line 15)May include surrounding context.

json
"agent"
  ],
  "keywords": [
    "self-evolve",
    "auto-evolve",
    "health-check",
    "autonomous",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly authorizes automatic creation and modification of workspace files such as SOUL.md, AGENTS.md, and MEMORY.md during a trigger phrase, but the user-facing description does not provide a clear upfront warning that invoking the skill may change persistent data. This creates a consent and integrity risk: a user may expect a status check or report, yet the skill can silently alter important state files and create new content, which could be abused or cause unintended configuration drift.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest’s human-readable description, notes, and operational rules are presented in Chinese throughout, which effectively imposes a single language on users and maintainers. No opt-in, language selection, or justification for a Chinese-only locale is provided in the file.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The emergency-stop rule uses broad wording ('用户说停止自主进化,立即禁用所有操作') without defining scope, authority, or which actions are covered. Ambiguous control phrases in machine-consumable policy can be abused to trigger denial of service, inconsistent enforcement, or prompt-level policy confusion across unrelated tasks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This Python file contains natural-language comments and CLI output entirely in Chinese, including usage/help text and audit messages. Because the file does not offer any language selection or explain that it is intended only for a Chinese-speaking or region-specific environment, it appears to impose a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The natural-language documentation and operational messaging are presented solely in Chinese, indicating a fixed language expectation without offering the user a choice or opt-in. Under the policy, forcing a specific language or locale without user selection is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The '--check-only' mode claims to perform checks without execution, but it returns immediately after printing a message and does not run the promised health or safety checks. This can mislead operators into believing validation occurred, causing unsafe assumptions and missed detection of problems before running the tool normally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script automatically rewrites MEMORY.md once it crosses a size threshold, replacing earlier content with a generated summary and recent lines, without explicit confirmation or backup in the same operation. In an agent skill context, silent modification of a long-term memory file can cause irreversible data loss, corruption of context, or manipulation of future agent behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script automatically moves old files from the temp directory into '.trash' without warning or confirmation. Although less severe than permanent deletion, this still mutates user data and can disrupt workflows or hide files unexpectedly, particularly because the operation may occur during normal message-triggered execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file presents itself as a health checker but actually imports and executes auto_evolve.main(), which is likely the skill's primary behavior rather than a minimal diagnostic. In a security-sensitive agent context, invoking the full routine during a health check can trigger unintended side effects, external actions, or state changes when callers expect a safe, read-only validation step.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file contains user-facing strings and comments exclusively in Chinese, including the skill description and runtime status/error messages. This indicates a fixed language choice without any visible opt-in or documented locale constraint, which matches the policy category for language/locale violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The code adds conversation-derived text into a ChromaDB vector store without notifying the user that session content will be embedded and retained. Vector stores can preserve semantically searchable traces of sensitive conversation content, making accidental disclosure or over-retention more likely in future retrievals or database exposure incidents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Session-derived content from SESSION-STATE.md is persisted to disk in the knowledge library without any consent, disclosure, or filtering for sensitive data. In an agent context, conversations may contain secrets, personal data, or operational details, so silently writing them to durable storage increases the risk of privacy leakage and later unauthorized access.

Content

No source excerpt is available for this finding.

Tainted flow: 'kb_file' from os.environ.get (line 129, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/knowledge_manager.py (reported line 130)May include surrounding context.

python
# 同时保存到文件库
    LIBRARY_DIR.mkdir(parents=True, exist_ok=True)
    kb_file = LIBRARY_DIR / f"{datetime.now().strftime('%Y%m%d')}_{topic.replace(' ', '_')}.md"
    with open(kb_file, "w", encoding="utf-8") as f:
        f.write(f"# 知识卡片\n\n")
        f.write(f"- **主题**: {topic}\n")
        f.write(f"- **版本**: {version}\n")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The feature list advertises behaviors including temporary file cleanup, skill directory scanning, memory compression, health checks, and report pushing, all of which can affect local state or expose system information. However, the manifest does not present corresponding user warnings, scope limitations, or consent language, increasing the risk of users enabling impactful functionality without understanding what data is touched or changed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest indicates activation by a natural-language phrase like ‘执行进化’, which is broad enough to be said in ordinary conversation or quoted indirectly. Because the skill performs system- and data-affecting actions such as cleanup, scanning, and memory compression, accidental or ambiguous triggering could cause unintended execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The natural-language instructions define activation using specific Chinese phrases such as 「执行进化」 and 「深度进化」, but the document does not offer alternate language options or indicate that the skill is intentionally limited to Chinese-speaking users. Under SQP-3, forcing a specific language without user opt-in is a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The natural-language comment at L2 is written only in Chinese and presents the file as an internal configuration without any indication that language choice is optional or region-specific. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The comment at L004 frames the script as primarily a harmless recorder for post-execution notification, which suggests a narrow L1/audit role. However, the implemented logic in query_level at L054-L055 assigns unknown operations to L2 with ASK, meaning the script also serves as an authorization/classification gate rather than merely recording actions.

Content

No source excerpt is available for this finding.