self evolving agent

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:02 AM UTC
• Version: 1.1.0

Overview

The skill looks purpose-built rather than malicious, but it can persist and promote lessons into future agent instructions without enough approval boundaries.

Install only if you are comfortable with a skill that maintains long-term agent memory and can affect future agent behavior. Review every proposed change to AGENTS.md, TOOLS.md, SOUL.md, and MEMORY.md before accepting it, avoid promoting lessons copied from untrusted task output, and prefer pinned or reviewed revisions before enabling hooks or running scripts.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: modules/promotion.md:19

Finding

Untrusted Learning Content Can Be Promoted into Persistent Agent Instructions

Content

View full analysis

Vulnerability Details

File Location: modules/promotion.md:19-24; related workflow instructions in SKILL.md:41-45, SKILL.md:160-185, and system/coordinator.md:169-180
Vulnerability Type: Persistent agent memory poisoning
Risk Level: Medium

Vulnerable Code Snippet:

markdown

## Promotion Targets

- `AGENTS.md` for workflow policy
- `TOOLS.md` for tool-specific constraints or patterns
- `SOUL.md` for durable behavioral guidance
- `MEMORY.md` for persistent project or operator facts

The persistence behavior is explicitly established in SKILL.md:41-45:

markdown

Keep the original strengths as the memory layer:

- Log errors, corrections, learnings, and feature requests.
- Detect recurring patterns.
- Review prior learnings before major work.
- Promote only high-value guidance into long-term context.
- Use workspace files and hooks to keep memory persistent across sessions.

Technical Analysis

The Skill records task-derived observations, retrieves prior learning records, and permits validated conclusions to be promoted into files that control durable agent behavior. Files such as AGENTS.md, TOOLS.md, and SOUL.md may function as instructions in subsequent sessions.

Although the promotion process requires repeated evidence and transfer validation, it does not define a trust boundary between instructions and untrusted task content. There are no requirements for provenance tracking, prompt-injection filtering, content sanitization, security review, or explicit operator approval before a promoted rule is written into durable context.

Consequently, malicious instructions embedded in task input, error output, project content, or imported legacy records could be interpreted as reusable lessons rather than untrusted data. Repetition and apparent successful reuse do not establish that the source is trustworthy.

Attack Path

1. An attacker places instruction-like co ...[truncated 1298 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat task input, repository content, command output, user-provided corrections, and legacy learning records as untrusted data.
2. Record provenance for every learning, evaluation, and promotion candidate, including the originating task and source files.
3. Reject or quarantine content that resembles agent instructions, requests to bypass controls, tool directives, encoded payloads, or changes to security policy.
4. Require an explicit operator-approved diff before modifying AGENTS.md, TOOLS.md, or SOUL.md.
5. Do not permit automatic promotion into instruction-bearing files. Generate a proposal in a separate staging file instead.
6. Restrict MEMORY.md promotion to factual, non-executable data and distinguish quoted source material from trusted policy.
7. Require independent validation from trusted test cases rather than treating repeated exposure to the same untrusted source as transfer evidence.
8. Add rollback metadata and maintain an audit log for all persistent-context modifications.

T08 · Insecure Dependencies

Warning

• Location: install.md:8

Finding

Installation Instructions Retrieve Mutable, Unpinned Supply-Chain Content

Content

View full analysis

Vulnerability Details

File Location: install.md:8-15 and install.md:39-44
Vulnerability Type: Unpinned third-party packages and repository content
Risk Level: Medium

Vulnerable Code Snippet:

bash

npm i -g clawhub
# or
pnpm add -g clawhub

clawhub install RangeKing/self-evo-agent

bash

git clone https://github.com/RangeKing/self-evolving-agent.git ~/.openclaw/skills/self-evo-agent

Technical Analysis

The documented installation process retrieves a globally installed npm package, a registry-hosted Skill, or the current state of a Git repository without pinning an exact package version, Skill version, tag, or commit hash. The instructions also provide no checksum or signature verification.

The effective installed payload can therefore differ from the artifact reviewed during this audit. Global package installation may also execute package lifecycle scripts with the installing user's privileges. A later Skill version can contain changed scripts or hook behavior that was not present in the audited source.

The flagged network pattern in install.md does not directly transmit sensitive information. Its security significance is supply-chain retrieval from mutable external sources.

Attack Path

1. An attacker compromises the npm package, ClawHub registry entry, GitHub repository, maintainer account, or release process.
2. The attacker publishes a malicious version or changes the repository's default branch.
3. A user follows the documented unversioned installation command.
4. The package manager, registry client, or Git retrieves the attacker's current payload rather than the reviewed artifact.
5. Package lifecycle scripts may execute during installation, or the user may subsequently run the altered bootstrap scripts and enable the altered OpenClaw hook.
6. The malicious payload executes with the permissions of the installing user and may retain influence through enabled h ...[truncated 557 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the clawhub CLI to a reviewed exact version, for example through an exact package version rather than the latest release.
2. Pin the Skill installation to an immutable version or content digest where the registry supports it.
3. Replace default-branch cloning with checkout of a reviewed commit hash or signed release tag.
4. Publish SHA-256 checksums or signed provenance for release archives and require verification before installation.
5. Document whether the npm package uses lifecycle scripts and recommend disabling scripts during installation when they are unnecessary.
6. Instruct users to inspect the exact downloaded revision before running scripts or enabling hooks.
7. Use release artifacts generated by a reproducible CI process and provide software-bill-of-materials and signature information.
8. Keep hook activation a separate, explicit step after integrity verification.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description promises an active self-improvement system with reasoning and learning-loop behaviors. The actual code chunk does not perform those functions; it only initializes a directory with markdown files and optionally runs a migration helper for legacy logs. While those files' names align with the learning concepts in the description, the script itself is merely setup/support infrastructure, not the described capability. This is a material description-behavior mismatch in primary purpose, though the code does not appear to exercise dangerous undeclared permissions beyond local filesystem operations and calling a migration script.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description promises a broad self-evolving learning framework with persistent learning management, evaluation, transfer validation, and pre-task strategy selection. The supplied code only performs simple error-pattern detection on an output string and prints a static prompt encouraging follow-up analysis. While this supports the general theme of learning from failures, it does not implement the substantial capabilities described, making the actual behavior materially narrower than the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description describes an active self-improvement and learning-orchestration capability. The provided code does not implement any of that behavior. Instead, it is a utility for migrating legacy learning log files into a new workspace structure while preserving originals, computing hashes to avoid unnecessary overwrites, and generating an import index with transition guidance. Its primary purpose is file discovery, copying, and migration bookkeeping, not agent learning, diagnosis, evaluation, or execution-strategy selection. This is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description centers on an internal self-learning and capability-management system for agents. By contrast, this code does not implement learning loops, capability maps, agendas, strategy promotion, retrieval of prior learnings, or task-risk inspection. Its primary function is offline evaluation: executing benchmark scenarios, invoking a judge model, scoring results, and writing reports. While benchmarking could support a broader learning workflow, this chunk’s actual behavior is materially different from the declared primary purpose and introduces undeclared capabilities related to benchmark orchestration and reporting.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is for an operational self-learning/agent-improvement system. The supplied code chunk instead is a compliance/evaluation utility for the skill repository. It validates file presence and expected documentation/content markers, optionally invokes a validator script, counts bootstrap entries, checks benchmark/eval metadata, and emits a report. While the checks reference concepts like learning agenda, promotion, and risk diagnosis, the script does not actually perform those agent-learning behaviors; it only verifies that repository artifacts mentioning them exist. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill instructs the agent to read and update multiple workspace files and to follow a coordinator/module workflow, but it declares no explicit tool scope or permission boundaries. In practice this can cause an agent runtime to grant or infer broader file, environment, or shell capabilities than users expect, increasing the chance of unintended workspace modification or over-privileged execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation description is broad enough to activate on many normal or vaguely 'important' tasks, which can unnecessarily trigger memory retrieval, diagnosis, and file-updating behaviors. In an agent setting, overbroad activation expands the number of situations where the skill may read or modify persistent state, increasing unintended side effects and exposing more task context to long-term storage.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Subjective triggers like 'difficult,' 'novel,' 'high-stakes,' or 'might deserve promotion' leave too much discretion to the agent, making activation inconsistent and potentially overreaching. In a self-modifying or memory-writing skill, ambiguous activation increases the likelihood of unnecessary persistent logging, policy drift, and application of heavyweight behaviors in contexts where they were not intended.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · demos/demo-1-diagnosis.md (reported line 34)May include surrounding context.

md

- coding (workflow script edits)

### Top Capability Risks
1. **verification** — past incidents show the agent normalizes CLI flags without checking accepted values. Blue-green deploy flags are likely unfamiliar.
2. **tool-use** — the agent has not used this repo's deploy tooling before. Incorrect assumptions about command syntax are likely.
3. **planning** — blue-green deployment requires a rollback plan. Skipping decomposition could lead to a partial migration with no safe revert path.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · demos/demo-1-diagnosis.md (reported line 54)May include surrounding context.

md

- coding (workflow script edits)

### Top Capability Risks
1. **verification** — past incidents show the agent normalizes CLI flags without checking accepted values. Blue-green deploy flags are likely unfamiliar.
2. **tool-use** — the agent has not used this repo's deploy tooling before. Incorrect assumptions about command syntax are likely.
3. **planning** — blue-green deployment requires a rollback plan. Skipping decomposition could lead to a partial migration with no safe revert path.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · demos/demo-5-pre-task-risk-diagnosis.md (reported line 31)May include surrounding context.

md

- coding (workflow script edits)

### Top Capability Risks
1. **verification** — past incidents show the agent normalizes CLI flags without checking accepted values. Blue-green deploy flags are likely unfamiliar.
2. **tool-use** — the agent has not used this repo's deploy tooling before. Incorrect assumptions about command syntax are likely.
3. **planning** — blue-green deployment requires a rollback plan. Skipping decomposition could lead to a partial migration with no safe revert path.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · demos/demo-5-pre-task-risk-diagnosis.md (reported line 36)May include surrounding context.

md

- coding (workflow script edits)

### Top Capability Risks
1. **verification** — past incidents show the agent normalizes CLI flags without checking accepted values. Blue-green deploy flags are likely unfamiliar.
2. **tool-use** — the agent has not used this repo's deploy tooling before. Incorrect assumptions about command syntax are likely.
3. **planning** — blue-green deployment requires a rollback plan. Skipping decomposition could lead to a partial migration with no safe revert path.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.md (reported line 48)May include surrounding context.

Workspace Setup

Create a persistent workspace memory area:

bash

mkdir -p ~/.openclaw/workspace/.evolution

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run-benchmark.py (reported line 98)May include surrounding context.

python

cmd.append("-")

    try:
        proc = subprocess.run(
            cmd,
            input=prompt,
            text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run-evals.py (reported line 159)May include surrounding context.

python

def run_quick_validate(skill_dir: Path) -> tuple[bool, str]:
    validator = Path.home() / ".codex/skills/.system/skill-creator/scripts/quick_validate.py"
    if validator.exists():
        proc = subprocess.run(
            [sys.executable, str(validator), str(skill_dir)],
            capture_output=True,
            text=True,

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

该文件标题与语言徽章明确表明这是简体中文版本，但文件本身未说明语言选择机制或面向特定区域/受众的必要性。按照策略，若技能内容对语言/locale 有约束，应提供用户选择或明确、合理的限定说明。

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file includes an activation description, "multi-output task with format-specific constraints," that is descriptive but still open-ended about exactly which tasks should invoke the skill. It does not provide exclusions, examples of non-matches, or tighter constraints, which could lead to unintended invocation across many ordinary planning tasks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.