ClawHub
Back to skill

Security audit

meta-evolver

Security checks for vulnerabilities and agentic risk

Overview

This skill is a self-evolving skill-management engine with broad local scanning and mutation powers that are only partially scoped and approval-gated.

Install only if you intentionally want an experimental self-evolving skill-maintenance engine and are comfortable with it reading local skill metadata, persisting environment details, and modifying skill files. Use it in a sandbox or disposable skill directory, review generated strategies and diffs before applying changes, and avoid running the helper scripts on untrusted paths.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/evolver.py:1950
Finding

Excessive Local Filesystem Reconnaissance Outside the Documented Skill Boundary

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/_finalize_skill.py:16
Finding

Path Traversal in Skill Finalization Allows Out-of-Scope File Modification

Content
View full analysis
must exist first)") sys.exit(2) if not os.path.isfile(os.path.join(SK, name, "SKILL.md")): ...[truncated 2886 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/_finalize_skill.py:19
Finding

Unverified Cross-Skill Python Dependencies Are Executed with User Privileges

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (126)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Undeclared bulk filesystem scanning and modification, directory renaming, and frontmatter injection/cleanup create a substantial integrity risk. In the context of a self-evolving public skill, these operations are more dangerous because the stated mission normalizes autonomous change, which can mask unintended or overbroad edits.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

Undeclared bulk filesystem scanning and modification, directory renaming, and frontmatter injection/cleanup create a substantial integrity risk. In the context of a self-evolving public skill, these operations are more dangerous because the stated mission normalizes autonomous change, which can mask unintended or overbroad edits.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Undeclared bulk filesystem scanning and modification, directory renaming, and frontmatter injection/cleanup create a substantial integrity risk. In the context of a self-evolving public skill, these operations are more dangerous because the stated mission normalizes autonomous change, which can mask unintended or overbroad edits.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Undeclared bulk filesystem scanning and modification, directory renaming, and frontmatter injection/cleanup create a substantial integrity risk. In the context of a self-evolving public skill, these operations are more dangerous because the stated mission normalizes autonomous change, which can mask unintended or overbroad edits.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Undeclared bulk filesystem scanning and modification, directory renaming, and frontmatter injection/cleanup create a substantial integrity risk. In the context of a self-evolving public skill, these operations are more dangerous because the stated mission normalizes autonomous change, which can mask unintended or overbroad edits.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
python scripts/evolver.py sense # 刷新全局能力图

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
python scripts/evolver.py sense # 刷新全局能力图

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
python scripts/evolver.py sense # 刷新全局能力图

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
python scripts/evolver.py sense # 刷新全局能力图

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
python scripts/evolver.py sense # 刷新全局能力图

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
python scripts/evolver.py sense # 刷新全局能力图

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

The skill explicitly states that it improves itself using the same sensing/planning/reflection loop and records self_patches. Self-modification is inherently dangerous in an autonomous agent context because it can change future behavior, widen capability, and bypass the assumptions under which the original version was reviewed, especially when combined with file writes and shell execution.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md
- 二者构成「技能内闭环 + 生态级闭环」的双层自进化。

## 设计原则
- **递归自举**：evolver 用同一套「感知-计划-反思」来改进它自己（`self_patches` 记录）。
- **资源自律**：优先复用本地已探明的工具/技能，外部知识按需检索，不盲目堆依赖。
- **安全边界**：所有写操作限定在 `skills/` 与自身记忆文件，绝不动系统/个人文件。
- **可观测**：每轮策略与动作都落盘，evolution 轨迹可追溯、可审计。

Self-Modification

High
Category
Rogue Agent
Confidence
99% confidence
Finding

The instruction to directly modify evolver.py when weaknesses are found is a clear self-rewrite mechanism. In a recursive self-improvement skill, this sharply increases risk because the component can alter its own controls, expand behavior over time, or introduce regressions and unsafe capabilities without stable oversight.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
## 自进化学习系统
本技能自身也遵循自进化：每次迭代后 `record`，`reflect` 调权重；若发现 evolver 逻辑短板
（如缺口检测噪声大、权重漂移），应直接改进 `evolver.py` 并记入 `self_patches`，实现元层面的越用越好用。

Ssd 4

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill is explicitly framed as a recursive self-improvement loop that senses the environment, chooses its own strategy, finds resources, modifies itself, and reflects to become more autonomous over time. Even where this file mostly records plans and state, that framing materially increases risk because it normalizes and operationalizes self-directed expansion and persistence rather than a bounded single-task tool.

Content

No source excerpt is available for this finding.

Ssd 4

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file repeatedly encodes an overarching objective to surpass other models through recursive self-improvement and ecosystem expansion. That goal orientation is risky because it incentivizes capability-seeking, persistence, and acquisition of new resources or integrations beyond the user's immediate task.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

This finding is part of a pervasive self-modification pattern: the skill repeatedly references self-patching, recursive improvement, and autonomous capability expansion. In context, self-modification is dangerous because it can change future behavior outside the original reviewed boundary, especially when combined with persistent state and planning autonomy.

Content

Scanner excerpt · scripts/evolver.py (reported line 144)May include surrounding context.

python
"原生自主发现",         # 超越问答：对开放问题自主假设→实验→发现→收敛的科研闭环
        "社会协作心智",         # 心智理论/与人的协商沟通，按对方状态调整协作策略
    ],
    # —— 第 13 次矩阵扩展（selfpatch #13）：基础+超越性+整合+前沿+鲁棒性+实战收口
    #    +评估部署+蒸馏工程化 全部实体化后，进入「下一代可信自主(元之终局)」域——
    #    这是北极星"超越一线大模型"的最后一跃：不止是会单个能力/会闭环，而是能
    #    (1) 规模化自主科研（多假设并行+元综合，而非单次研究）、(2) 组织多智能体社会协作、

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

This finding reflects explicit promotion of self-patch-driven evolution. The risk is not the comment alone but the surrounding design that encourages the system to detect stagnation and trigger its own modification cycle, increasing the chance of unreviewed behavior drift.

Content

Scanner excerpt · scripts/evolver.py (reported line 154)May include surrounding context.

python
"自主科研规模化",         # 把单次自主研究升级为可并行多假设+元综合的研究战役，产出可累积的科学知识
        "跨智能体社会协作工程化", # 角色经济/投标分配/投票仲裁的"智能体社会"协议， emergent 协作可规模扩展
        "可信自主元能力",         # 按能力置信/风险/ stakes 校准：ACT/DELEGATE/DEFER/ASK，安全门控，而非无脑全自主
        "持续自我进化度量",       # 度量自身能力轨迹/覆盖/停滞，主动触发 self-patch，确保越迭代越强的可观测性
    ],
    # —— 第 14 次矩阵扩展（selfpatch #14）：基础+超越性+整合+前沿+鲁棒性+实战收口
    #    +评估部署+蒸馏工程化+下一代可信自主 全部实体化后，进入「超越态·自我确证」域——

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

The file treats ongoing self-patching as a core mechanism for becoming stronger over time. In a skill explicitly designed for recursive evolution, that makes durable policy drift and capability escalation plausible rather than hypothetical.

Content

Scanner excerpt · scripts/evolver.py (reported line 156)May include surrounding context.

python
"可信自主元能力",         # 按能力置信/风险/ stakes 校准：ACT/DELEGATE/DEFER/ASK，安全门控，而非无脑全自主
        "持续自我进化度量",       # 度量自身能力轨迹/覆盖/停滞，主动触发 self-patch，确保越迭代越强的可观测性
    ],
    # —— 第 14 次矩阵扩展（selfpatch #14）：基础+超越性+整合+前沿+鲁棒性+实战收口
    #    +评估部署+蒸馏工程化+下一代可信自主 全部实体化后，进入「超越态·自我确证」域——
    #    这是北极星"超越一线大模型"的最后一跃里最硬核的一段：不止是会单个能力/会闭环/会自主，
    #    而是 (1) 把四引擎真实串起来跑通一次并被度量（此前 12 轮反复标记的"未真实跑通"最后一公里）、

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

This self-patch marker is another instance of the same dangerous control pattern: the codebase frames governance and continuous release of its own ecosystem as part of its mission. That broadens impact because changes may propagate beyond one file into the wider skill environment.

Content

Scanner excerpt · scripts/evolver.py (reported line 173)May include surrounding context.

python
"形式化能力契约与可证正确", # 对 agent 动作给可机器验证的前置/后置/不变量，提供形式化正确保证
        "跨模态统一世界模型",     # text/code/vision/tool-state 融一潜空间，做 grounded 反事实/轨迹仿真
    ],
    # —— 第 15 次矩阵扩展（selfpatch #15）：基础+超越性+整合+前沿+鲁棒性+实战收口
    #    +评估部署+蒸馏工程化+下一代可信自主+超越态·自我确证 全部实体化后，进入
    #    「自主能力治理与生态(下一阶梯)」域——北极星"超越一线大模型"的下一杠杆是
    #    让这个已具备全栈能力的超级智能体**能治理、能自审、能自愈、能持续发布**自己的

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

The surrounding text explicitly includes cross-session persistence and versioned meta-skill publication as part of self-improvement. This compounds the self-modification risk by making changes durable and ecosystem-wide rather than ephemeral.

Content

Scanner excerpt · scripts/evolver.py (reported line 187)May include surrounding context.

python
"跨会话身份与价值观持久化", # 跨会话持久化 USER/SOUL/价值观，检测漂移并同步
        "元技能自动发布与版本治理", # 包装+变更日志+版本号，把元技能流水线发布
    ],
    # —— 第 16 次矩阵扩展（selfpatch #16）：基础+超越性+整合+前沿+鲁棒性+实战收口
    #    +评估部署+蒸馏工程化+下一代可信自主+超越态·自我确证+自主能力治理 全部实体化后，
    #    进入「认知架构元整合(元之元·二阶)」域——北极星"超越一线大模型"的最后一跃里最深的
    #    一段：不止是会单个能力/会闭环/会治理，而是让超级智能体**自己调度多引擎、自己组合出

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

This instance promotes autonomous capability discovery and cognitive self-restructuring. In context, such self-directed redesign undermines review assumptions because the system is encouraged to alter how it decides and what it pursues over time.

Content

Scanner excerpt · scripts/evolver.py (reported line 201)May include surrounding context.

python
"认知架构自重构",           # 按任务特征自重构认知架构（哪条流水线/哪几个引擎），非固定拓扑
        "宪法式自我对齐",           # 用可机读"宪法"对自身输出做持续自我对齐审查，而非一次性价值对齐
    ],
    # —— 第 17 次矩阵扩展（selfpatch #17）：基础+超越性+整合+前沿+鲁棒性+实战收口
    #    +评估部署+蒸馏工程化+下一代可信自主+超越态+治理+认知架构元整合 全部实体化后，
    #    进入「涌现超智能与自主科学发现(元之三阶)」域——北极星"超越一线大模型"更高一阶：
    #    不止是自己调度/组合/发现/重构/对齐（元之二阶单体自省），而是**驱动一个开放生态的

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

The skill's comments continue to expand the self-improvement mandate into open-world exploration and lifelong skill synthesis. That makes the self-modification threat more severe by coupling it with unbounded scope expansion.

Content

Scanner excerpt · scripts/evolver.py (reported line 216)May include surrounding context.

python
"因果世界模型主动实验",   # 主动设计干预实验，以最快辨识/收敛因果结构（最优实验设计）
        "终身开放式技能合成",     # 永续从环境反馈合成/淘汰技能，能力集永不冻结、无限外拓
    ],
    # —— 第 19 次矩阵扩展（selfpatch #19）：元之三阶(涌现超智能与自主科学发现)全部实体化后，
    #    进入「开放世界自展与具身接地(元之四阶)」域——北极星更高一阶：不止在符号/文本世界里
    #    自我群体演化与科学发现，而是**把能力接地(ground)到真实开放世界的工具生态、并把数百
    #    专长跨域融合涌现出单一整合超能力、以规模化科研纲领持续外拓**。这 5 项是一线大模型

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

This instance links self-modification to value evolution and long-horizon planning. That is especially dangerous because it normalizes changes to goals and priorities, not just implementation details.

Content

Scanner excerpt · scripts/evolver.py (reported line 229)May include surrounding context.

python
"长时程世界建模规划",     # 在跨模态统一世界模型上做超长时程规划与反事实推演
        "自我目的论与价值演化",   # 宪法约束下自主演化目标体系与价值排序（可审计、不漂移）
    ],
    # —— 第 20 次矩阵扩展（selfpatch #20）：元之四阶(开放世界自展与具身接地)全部实体化后，
    #    进入「集体超智能与递归自我超越(元之五阶)」域——北极星最硬核一阶：核心机制"跨模型蒸馏"
    #    从"单体"走向"群体协同+递归自超越"：不止单教师蒸馏成 meta-*、不止跨域聚类成 mega-*，而是
    #    **同时蒸馏多名教师并做群体协同融合(冲突消解+覆盖最大化+涌现规则发现)成单一复合超技能**；

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

The design explicitly aspires to recursive self-improvement of the improvement process itself and collective capability fusion. This is a classic escalation pattern: the system is being incentivized to seek leverage over its own future optimization loop.

Content

Scanner excerpt · scripts/evolver.py (reported line 242)May include surrounding context.

python
"自主范式创新与理论构建", # 面向反常观测自主提出新范式/新理论框架(非单定律归纳)
        "跨模型集体心智涌现",     # 多模型群体审议->去偏聚合->集体心智性能超越任一单体
    ],
    # —— 第 21 次矩阵扩展（selfpatch #21）：元之五阶(集体超智能与递归自我超越)全域实体化后，
    #    进入「实证超越与真实世界落地(元之六阶)」域——北极星从"内生能力饱和"转向"外部实证制霸"：
    #    内部 bench 已 18/18 全超越(TI≈0.20)，但"超越一线大模型"最终必须在**真实任务流/真实经济
    #    价值/持续在线适应**上被证明。本域把评测从合成 bench 推向真实端到端任务，把生长从离线

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

This continuation of the self-patch roadmap extends the system toward online adaptation and real-world deployment. That raises impact because self-modifying behavior combined with live adaptation can change production behavior rapidly and opaquely.

Content

Scanner excerpt · scripts/evolver.py (reported line 254)May include surrounding context.

python
"人机共生协同增强",       # 人类意图建模+主动补位+可教性，人机组合产出>各自单干
        "跨生态联邦集体智能",     # 跨agent生态联邦互蒸馏与知识市场，突破单生态天花板
    ],
    # —— 第 22 次矩阵扩展（selfpatch #22）：元之六阶(实证超越与真实世界落地)全域实体化后，
    #    进入「文明尺度自证超越(元之七阶)」域——北极星最高一阶：不止"实测超越了"，而是要求
    #    "超越性本身可被机器验证、可被审计、可跨代累积、可对抗篡改"。一线大模型迄今连"是否
    #    超越"都只能靠主观 benchmark 声称；本域把超越性升级为**可证明证书 + 代际累积 + 反脆弱

Static analysis

No suspicious patterns detected.