Security audit

Skill Evolver

Security checks across malware telemetry and agentic risk

Overview

The skill is broadly coherent, but it needs Review because it can automatically read agent session logs, use LLM credentials, send trace/unit content to model endpoints, persist derived history, and edit other skills' SKILL.md files.

Install only if you are comfortable letting this skill inspect agent session logs, use or auto-detect LLM access, send trace/unit text to the configured model provider, and update other skills' SKILL.md files. For sensitive environments, set privacy.allowRemoteLLM to false, use manual mode, review generated units before inlining, and avoid enabling scheduling until the missing setup/schedule documentation mismatch is resolved.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: This adapter extracts LLM provider API credentials from OpenClaw configuration and returns them to the broader skill system, even though the stated purpose of the skill is to analyze local execution traces and evolve skills. That creates an unnecessary secret-access capability and expands the trust boundary: if other parts of the skill log, transmit, or misuse the returned object, provider credentials could be exposed or used for unauthorized outbound inference.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The clear/block functionality can modify live SKILL.md files for other skills by locating them through platform search paths and stripping inline blocks, which gives this CLI cross-skill write capability beyond simple management of its own EU files. Even with the skill-name validation and skipping bundled extensions, an invoked user or agent can alter the behavior of unrelated skills, creating an integrity risk and an opportunity for denial of service against the broader skill ecosystem.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The validator sends full execution traces and full unit contents to an external LLM during triage and attribution. Those traces can contain sensitive prompts, user data, secrets, or internal repository context, and the transfer exceeds a narrowly local 'evidence-based' validator design; in a self-modifying skill system, this broad exfiltration surface is especially risky.

Description-Behavior Mismatch

Medium

Confidence: 85% confidence
Finding: The graduated-coverage scan walks all skill directories and evaluates unit relationships repository-wide, which expands the script's scope beyond the provided trace set. In practice this increases unintended data exposure, can affect unrelated skills' evidence state, and makes the validator capable of broad cross-skill influence in a system that writes evolution evidence.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill advertises notification delivery via webhook or shell command, but the documentation provides no strong warning that a configured shell command is code execution. If an attacker or unsafe config can influence that command or its arguments, this becomes an arbitrary command execution path under the agent's privileges.

Missing User Warnings

Low

Confidence: 93% confidence
Finding: The script constructs a shell command in a single string and then expands it unquoted into `bash ... $RUN_ARGS`, while also appending user-controlled values such as `--sessions-dir`, `--since`, `--filter-skill`, and `--hint`. This can lead to shell word-splitting and argument injection, allowing unexpected flags or malformed values to alter how `run-daily.sh` executes; in an agent skill that processes external trace data and accepts operator input, that makes the issue more dangerous than a purely local helper script.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: This script sends full execution traces to a remote LLM whenever remote use is enabled, but the only safeguard is a config flag checked at runtime. In a skill-evolution system, traces can easily contain sensitive prompts, tool outputs, file paths, secrets, or user data, so transmitting them off-box without clear operator notice and explicit consent creates a real confidentiality risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The reviewer sends full unit content, plus skill name and description, to a configurable external LLM endpoint for classification. That creates a real confidentiality risk because generated units may contain sensitive data, prompt-injection payloads, or internal context, and this file provides no minimization, redaction, or consent gate before transmission.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script persists derived trace history and validation evidence into long-lived JSONL files under the working directory, while handling session data that may contain sensitive agent traces, prompts, tool outputs, or user content. There is no explicit consent gate, retention notice, minimization control, or access protection in this flow, so sensitive data can accumulate silently and be exposed later through local compromise, backup collection, or unintended sharing.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The call sites transmit execution traces and patch contents to a remote LLM without an explicit user-facing warning or per-run confirmation. Because traces in agent systems often contain sensitive operational data, and this skill evolves behavior from those traces, silent remote disclosure materially raises privacy, compliance, and prompt/data leakage risk.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/lib/llm-client.js:471

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/monitor.js:209

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/preflight.js:230

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/reviewer.js:125

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/preflight.js:285