Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Capability Evolver.Bak

v1.0.0

A self-evolution engine for AI agents. Analyzes runtime history to identify improvements and applies protocol-constrained evolution.

⭐ 0· 72·0 current·0 all-time

bySam@samwlh·fork of @autogame-17/capability-evolver (1.32.2)

MIT-0

Download zip

LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.

Security Scan

VirusTotal

Pending

View report →

OpenClaw

Benign

medium confidence

✓

Purpose & Capability

Name/description match the actual footprint: Node.js code that analyzes logs, selects 'genes', and can produce/solidify code changes. Required binaries (node, git) and declared file accesses (workspace/src, assets, memory) are appropriate for a self‑evolver.

ℹ

Instruction Scope

SKILL.md and code instruct the agent to read runtime history and workspace files and to communicate with an EvoMap hub and optional GitHub API. It also reads ~/.evomap/node_id and workspace memory/artifacts. This is consistent with the stated purpose but broad: the skill can ingest external assets, run validation scripts, and publish evolution events. Expect wide file I/O and outbound network traffic if enabled.

✓

Install Mechanism

No external download/extract install spec is present; the bundle includes full source. There is no opaque URL or remote installer — lower install risk from this metadata. Runtime does use npm/node commands for validation/healing but those are normal for Node projects.

ℹ

Credentials

Only A2A_NODE_ID is required; other credentials (A2A_NODE_SECRET, GITHUB_TOKEN, MEMORY_GRAPH_REMOTE_KEY) are optional and justified by features (hub auth, GitHub issue/release automation, remote KG). However supplying GITHUB_TOKEN or A2A_NODE_SECRET grants network write capabilities (issue creation, publish/heartbeat) so they should only be provided when you trust the hub/upstream.

ℹ

Persistence & Privilege

always:false (not force-included) and model invocation allowed (platform default). The skill can run as a daemon (loop mode), spawn restarts, write evolved code into workspace/src/**, and has an explicit EVOLVE_ALLOW_SELF_MODIFY flag to permit editing its own source. These are coherent for an evolver but are powerful: do not enable self-modify or hub credentials unless you intend persistent autonomous editing and publishing.

Assessment

This package appears to be what it claims (a self‑evolution engine) but it is powerful and persistent — treat it like an autonomous agent runtime. Before installing or enabling network/auth: - Start in review mode: run `node index.js --review` or `node index.js run` and inspect proposed changes before solidification. - Do not set EVOLVE_ALLOW_SELF_MODIFY=true unless you fully trust the code and upstream. Keep the default (false) during evaluation. - Avoid providing A2A_NODE_SECRET or GITHUB_TOKEN until you understand what will be published; these tokens allow the skill to authenticate to remote services and create issues/releases. - Run first in an isolated/sandboxed workspace (or a VM/container) and back up your repo before allowing any solidify/write operations. - Audit the assets in assets/gep and any external candidates before promoting; promotion tools require an explicit --validated flag. - Review solidify validation logic: validation commands are restricted to node/npm/npx, no shell operators, 180s timeout — still confirm these checks meet your security posture. - Restrict outbound network egress (or set A2A_HUB_URL to a test endpoint) during initial trials to prevent unintended publishing. If you need a lower-risk test: run the code with network disabled and without setting optional secrets to observe its behavior and generated reports only.

✗

index.js:214