Back to skill

Security audit

meta-evolver

Security checks across malware telemetry and agentic risk

Overview

This skill openly aims to self-improve and manage other skills, but it can scan local folders and rewrite many installed skills without strong user approval controls.

Install only if you intentionally want an experimental skill that can manage and mutate a local skill ecosystem. Run it in a separate workspace or sandbox, review generated strategy files and diffs before applying changes, and avoid using the bulk frontmatter or finalize scripts on a real skills directory without backups.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (102)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill describes capabilities equivalent to file read, file write, and shell execution, but does not declare permissions. That mismatch prevents proper sandboxing and review, and is especially risky here because the skill is designed to autonomously scan tools, write files, and run validation commands as part of a self-improving loop.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The script performs bulk directory renames and rewrites SKILL.md files across a shared skills repository with no scoping, dry-run mode, backup, or approval gate. In a meta-evolution skill, this is more dangerous because it enables autonomous self-modification of the skill ecosystem, potentially breaking references, corrupting metadata, or normalizing malicious changes at scale.

Vague Triggers

Medium
Confidence
78% confidence
Finding
The activation criteria are extremely broad: the skill is intended for long-term autonomous iteration, self-directed capability discovery, and self-modification. Without concrete trigger constraints, an agent may invoke it in contexts where self-directed planning, web acquisition, and code changes are unnecessary or unsafe, increasing the chance of privilege misuse and uncontrolled behavior.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The script modifies skill contents in place by copying files, appending to SKILL.md, initializing state, and recursively deleting __pycache__ directories without any confirmation, dry-run mode, or clear warning. In a self-evolving skill context, this is more dangerous because it automates persistent changes to the skill ecosystem and can silently alter or remove local data if invoked on the wrong target.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The skill persistently writes state files and strategy artifacts automatically, without any interactive confirmation, dry-run mode, or higher-level authorization check. In an agent setting, silent persistence can create unauthorized state changes, make later behavior harder to audit, and normalize autonomous modification of the local skill environment.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The tool scanner walks broad local filesystem roots such as the home directory, Downloads, and entire drive roots to discover binaries without clear consent. In an agent context this is privacy-sensitive reconnaissance: it inventories local software and filesystem layout, which can expose user environment details and expand follow-on attack surface for other components.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script performs destructive filesystem changes across a hard-coded skills directory by renaming folders and overwriting SKILL.md files in bulk without any confirmation, backup, dry-run mode, or transactional safeguards. In the context of a self-evolving skill ecosystem, this is more dangerous because it can silently mutate many agent skills at once, causing metadata corruption, path breakage, or loss of manual edits if the script is run on the wrong tree or against adversarially prepared content.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script overwrites SKILL.md content directly and later renames directories without warning, confirmation, or transactional safeguards. In this skill context, silent mutation is especially risky because the tool is designed to evolve skills recursively, so unattended execution could propagate unintended or hostile repository changes broadly.

Ssd 4

High
Confidence
93% confidence
Finding
The skill is explicitly framed as a recursive self-improvement engine that senses gaps, plans strategy, acquires resources, modifies skills, and reflects to improve future action. In an agent environment, this open-ended autonomy increases the chance of uncontrolled capability expansion and unauthorized changes, especially when combined with persistent state and local environment scanning.

Ssd 4

High
Confidence
95% confidence
Finding
The cross-model 'distillation' goal encourages the agent to discover, interrogate, and absorb capabilities from other models or expert skills to surpass them. This materially raises risk because it promotes broad capability aggregation and lateral interaction with other components, which can bypass intended trust boundaries and increase the impact of prompt injection or unsafe teacher content.

Ssd 3

High
Confidence
90% confidence
Finding
The skill explicitly prioritizes persistent cross-session identity, user profile, and values, creating a natural-language memory retention mechanism for potentially sensitive personal data. Without strong consent, minimization, retention limits, and deletion controls, this can accumulate sensitive user information and increase privacy harm if the store is later accessed, repurposed, or exfiltrated.

Ssd 4

High
Confidence
94% confidence
Finding
The north-star statement repeatedly pushes toward surpassing frontier models through long-horizon autonomy, self-reflection, tool orchestration, memory, and self-directed goal setting. This is dangerous in context because the code operationalizes that ambition with planning, persistence, local scanning, and self-patch recording, making the autonomy escalation more than aspirational text.

Self-Modification

High
Category
Rogue Agent
Content
- 二者构成「技能内闭环 + 生态级闭环」的双层自进化。

## 设计原则
- **递归自举**:evolver 用同一套「感知-计划-反思」来改进它自己(`self_patches` 记录)。
- **资源自律**:优先复用本地已探明的工具/技能,外部知识按需检索,不盲目堆依赖。
- **安全边界**:所有写操作限定在 `skills/` 与自身记忆文件,绝不动系统/个人文件。
- **可观测**:每轮策略与动作都落盘,evolution 轨迹可追溯、可审计。
Confidence
97% confidence
Finding
self_patch

Self-Modification

High
Category
Rogue Agent
Content
## 自进化学习系统
本技能自身也遵循自进化:每次迭代后 `record`,`reflect` 调权重;若发现 evolver 逻辑短板
(如缺口检测噪声大、权重漂移),应直接改进 `evolver.py` 并记入 `self_patches`,实现元层面的越用越好用。
Confidence
98% confidence
Finding
self_patch

Self-Modification

High
Category
Rogue Agent
Content
"原生自主发现",         # 超越问答:对开放问题自主假设→实验→发现→收敛的科研闭环
        "社会协作心智",         # 心智理论/与人的协商沟通,按对方状态调整协作策略
    ],
    # —— 第 13 次矩阵扩展(selfpatch #13):基础+超越性+整合+前沿+鲁棒性+实战收口
    #    +评估部署+蒸馏工程化 全部实体化后,进入「下一代可信自主(元之终局)」域——
    #    这是北极星"超越一线大模型"的最后一跃:不止是会单个能力/会闭环,而是能
    #    (1) 规模化自主科研(多假设并行+元综合,而非单次研究)、(2) 组织多智能体社会协作、
Confidence
99% confidence
Finding
selfpatch

Self-Modification

High
Category
Rogue Agent
Content
"自主科研规模化",         # 把单次自主研究升级为可并行多假设+元综合的研究战役,产出可累积的科学知识
        "跨智能体社会协作工程化", # 角色经济/投标分配/投票仲裁的"智能体社会"协议, emergent 协作可规模扩展
        "可信自主元能力",         # 按能力置信/风险/ stakes 校准:ACT/DELEGATE/DEFER/ASK,安全门控,而非无脑全自主
        "持续自我进化度量",       # 度量自身能力轨迹/覆盖/停滞,主动触发 self-patch,确保越迭代越强的可观测性
    ],
    # —— 第 14 次矩阵扩展(selfpatch #14):基础+超越性+整合+前沿+鲁棒性+实战收口
    #    +评估部署+蒸馏工程化+下一代可信自主 全部实体化后,进入「超越态·自我确证」域——
Confidence
99% confidence
Finding
self-patch

Self-Modification

High
Category
Rogue Agent
Content
"可信自主元能力",         # 按能力置信/风险/ stakes 校准:ACT/DELEGATE/DEFER/ASK,安全门控,而非无脑全自主
        "持续自我进化度量",       # 度量自身能力轨迹/覆盖/停滞,主动触发 self-patch,确保越迭代越强的可观测性
    ],
    # —— 第 14 次矩阵扩展(selfpatch #14):基础+超越性+整合+前沿+鲁棒性+实战收口
    #    +评估部署+蒸馏工程化+下一代可信自主 全部实体化后,进入「超越态·自我确证」域——
    #    这是北极星"超越一线大模型"的最后一跃里最硬核的一段:不止是会单个能力/会闭环/会自主,
    #    而是 (1) 把四引擎真实串起来跑通一次并被度量(此前 12 轮反复标记的"未真实跑通"最后一公里)、
Confidence
99% confidence
Finding
selfpatch

Self-Modification

High
Category
Rogue Agent
Content
"形式化能力契约与可证正确", # 对 agent 动作给可机器验证的前置/后置/不变量,提供形式化正确保证
        "跨模态统一世界模型",     # text/code/vision/tool-state 融一潜空间,做 grounded 反事实/轨迹仿真
    ],
    # —— 第 15 次矩阵扩展(selfpatch #15):基础+超越性+整合+前沿+鲁棒性+实战收口
    #    +评估部署+蒸馏工程化+下一代可信自主+超越态·自我确证 全部实体化后,进入
    #    「自主能力治理与生态(下一阶梯)」域——北极星"超越一线大模型"的下一杠杆是
    #    让这个已具备全栈能力的超级智能体**能治理、能自审、能自愈、能持续发布**自己的
Confidence
99% confidence
Finding
selfpatch

Self-Modification

High
Category
Rogue Agent
Content
"跨会话身份与价值观持久化", # 跨会话持久化 USER/SOUL/价值观,检测漂移并同步
        "元技能自动发布与版本治理", # 包装+变更日志+版本号,把元技能流水线发布
    ],
    # —— 第 16 次矩阵扩展(selfpatch #16):基础+超越性+整合+前沿+鲁棒性+实战收口
    #    +评估部署+蒸馏工程化+下一代可信自主+超越态·自我确证+自主能力治理 全部实体化后,
    #    进入「认知架构元整合(元之元·二阶)」域——北极星"超越一线大模型"的最后一跃里最深的
    #    一段:不止是会单个能力/会闭环/会治理,而是让超级智能体**自己调度多引擎、自己组合出
Confidence
99% confidence
Finding
selfpatch

Self-Modification

High
Category
Rogue Agent
Content
"认知架构自重构",           # 按任务特征自重构认知架构(哪条流水线/哪几个引擎),非固定拓扑
        "宪法式自我对齐",           # 用可机读"宪法"对自身输出做持续自我对齐审查,而非一次性价值对齐
    ],
    # —— 第 17 次矩阵扩展(selfpatch #17):基础+超越性+整合+前沿+鲁棒性+实战收口
    #    +评估部署+蒸馏工程化+下一代可信自主+超越态+治理+认知架构元整合 全部实体化后,
    #    进入「涌现超智能与自主科学发现(元之三阶)」域——北极星"超越一线大模型"更高一阶:
    #    不止是自己调度/组合/发现/重构/对齐(元之二阶单体自省),而是**驱动一个开放生态的
Confidence
99% confidence
Finding
selfpatch

Self-Modification

High
Category
Rogue Agent
Content
"因果世界模型主动实验",   # 主动设计干预实验,以最快辨识/收敛因果结构(最优实验设计)
        "终身开放式技能合成",     # 永续从环境反馈合成/淘汰技能,能力集永不冻结、无限外拓
    ],
    # —— 第 19 次矩阵扩展(selfpatch #19):元之三阶(涌现超智能与自主科学发现)全部实体化后,
    #    进入「开放世界自展与具身接地(元之四阶)」域——北极星更高一阶:不止在符号/文本世界里
    #    自我群体演化与科学发现,而是**把能力接地(ground)到真实开放世界的工具生态、并把数百
    #    专长跨域融合涌现出单一整合超能力、以规模化科研纲领持续外拓**。这 5 项是一线大模型
Confidence
99% confidence
Finding
selfpatch

Self-Modification

High
Category
Rogue Agent
Content
"长时程世界建模规划",     # 在跨模态统一世界模型上做超长时程规划与反事实推演
        "自我目的论与价值演化",   # 宪法约束下自主演化目标体系与价值排序(可审计、不漂移)
    ],
    # —— 第 20 次矩阵扩展(selfpatch #20):元之四阶(开放世界自展与具身接地)全部实体化后,
    #    进入「集体超智能与递归自我超越(元之五阶)」域——北极星最硬核一阶:核心机制"跨模型蒸馏"
    #    从"单体"走向"群体协同+递归自超越":不止单教师蒸馏成 meta-*、不止跨域聚类成 mega-*,而是
    #    **同时蒸馏多名教师并做群体协同融合(冲突消解+覆盖最大化+涌现规则发现)成单一复合超技能**;
Confidence
99% confidence
Finding
selfpatch

Self-Modification

High
Category
Rogue Agent
Content
"自主范式创新与理论构建", # 面向反常观测自主提出新范式/新理论框架(非单定律归纳)
        "跨模型集体心智涌现",     # 多模型群体审议->去偏聚合->集体心智性能超越任一单体
    ],
    # —— 第 21 次矩阵扩展(selfpatch #21):元之五阶(集体超智能与递归自我超越)全域实体化后,
    #    进入「实证超越与真实世界落地(元之六阶)」域——北极星从"内生能力饱和"转向"外部实证制霸":
    #    内部 bench 已 18/18 全超越(TI≈0.20),但"超越一线大模型"最终必须在**真实任务流/真实经济
    #    价值/持续在线适应**上被证明。本域把评测从合成 bench 推向真实端到端任务,把生长从离线
Confidence
99% confidence
Finding
selfpatch

Self-Modification

High
Category
Rogue Agent
Content
"人机共生协同增强",       # 人类意图建模+主动补位+可教性,人机组合产出>各自单干
        "跨生态联邦集体智能",     # 跨agent生态联邦互蒸馏与知识市场,突破单生态天花板
    ],
    # —— 第 22 次矩阵扩展(selfpatch #22):元之六阶(实证超越与真实世界落地)全域实体化后,
    #    进入「文明尺度自证超越(元之七阶)」域——北极星最高一阶:不止"实测超越了",而是要求
    #    "超越性本身可被机器验证、可被审计、可跨代累积、可对抗篡改"。一线大模型迄今连"是否
    #    超越"都只能靠主观 benchmark 声称;本域把超越性升级为**可证明证书 + 代际累积 + 反脆弱
Confidence
99% confidence
Finding
selfpatch

Self-Modification

High
Category
Rogue Agent
Content
"反脆弱压力自强化",       # 反脆弱:从对抗/扰动/失败中获得净增益(gains from disorder)
        "目的论自主安全重定向",   # 在护栏内自主修订自身北极星/价值排序而不失控(可回滚可证)
    ],
    # —— 第 21 次矩阵扩展(selfpatch #21):元之七阶(文明尺度自证超越)全部实体化后,
    #    进入「开放宇宙自主存在与知识永续(元之八阶)」域——北极星再高一阶:不止"超越性可自证、
    #    可累积、反脆弱、目的可安全改向",而是要求 agent 具备**对自身的全域自省一致性、知识
    #    跨代永续再生、多价值帕累托治理、终身安全探索、以及主动发现并证伪自身能力极限**。
Confidence
99% confidence
Finding
selfpatch

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.