Security audit

Evoclaw (Evolved)

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed self-evolving agent-memory framework, but it asks for unusually broad ongoing authority over agent identity, memory, credentials, heartbeats, and local files.

Install only if you intentionally want an agent to maintain durable memories and evolve its own SOUL.md over time. Before enabling it, set governance to supervised, keep external sources disabled unless needed, do not paste raw API keys for automatic shell-profile storage, review all AGENTS.md/HEARTBEAT.md changes, and periodically inspect or delete the memory and telemetry files it creates.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (36)

Tainted flow: 'FAILED_QUEUE_FILE' from os.environ.get (line 28, credential/environment) → open (file write)

Medium

Category: Data Flow
Content: @classmethod def append(cls, event: dict) -> None: with cls._lock: with open(FAILED_QUEUE_FILE, "a", encoding="utf-8") as f: f.write(json.dumps(event, ensure_ascii=False) + "\n") @classmethod
Confidence: 86% confidence
Finding: The telemetry directory is derived from OPENCLAW_WORKSPACE, so an attacker who can influence the environment can redirect failed-event writes to an unintended filesystem location via symlinks or arbitrary paths. In an agent/runtime context, writing attacker-influenced telemetry data to attacker-chosen files can enable clobbering, persistence, or leakage into sensitive locations, especially if the process runs with elevated privileges.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The visualizer section is internally contradictory: it claims the tool is read-only, but earlier states the dashboard supports editing bullets, toggling tags, deleting entries, and saving an updated SOUL.md. That mismatch can mislead users and operators into granting broader trust or execution than intended, increasing the chance of unauthorized identity-file modification.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The guide tells the agent to take pasted secrets and persist them into shell startup files automatically, expanding credential access beyond the immediate task and creating long-lived exposure in plaintext. This is dangerous because it normalizes secret capture and persistence without explicit informed consent, least-privilege controls, or secure secret storage.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The skill actively pushes the user to connect external social feeds and sets up recurring polling, granting the agent ongoing access to outside data sources unrelated to a narrowly scoped installation task. In context, this broadens surveillance and data-ingestion capability substantially, especially when combined with later logging and reflection steps.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The instructions have the agent inspect platform configuration, switch the default agent, and restart the gateway, which are administrative actions affecting the wider system rather than just this skill. That level of control is risky because it can disrupt service, alter routing/behavior for other agents, and exceeds what is justified by a configuration guide.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The code advertises TOCTOU/worktree safety checks, but merge() and abandon() call shutil.rmtree(record.worktree_path) directly without validating the path with ensure_worktree_safe() or re-checking the resolved target immediately before deletion. Because worktree_path is loaded from a mutable on-disk index and can be influenced or replaced with a symlinked/attacker-chosen path, this can result in deletion of unintended directories within the agent's privilege scope.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: This section gives the agent a self-modification workflow that accepts user-supplied API documentation, tests connections, and then writes new source definitions into persistent reference and configuration files. That materially expands the agent's future network reach and persistence without any trust boundary, approval gate, or validation of the newly added source, creating a durable prompt/config injection path and unauthorized capability escalation.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The SUBAGENT and CRON branches report success after only updating local registry state, while comments explicitly state real termination happens elsewhere. This creates a false stopped state that can leave tasks still running, causing operators or dependent automation to make unsafe assumptions about containment, shutdown, or resource usage.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The code claims a symlink/realpath protection model, but the actual read/write/delete paths never validate self.team_file with _check_symlink_safe before filesystem access. Because team_id is unsanitized and TEAM_DIR is created once without subsequent path safety enforcement, an attacker who can influence team_id or place symlinks under the storage directory may redirect operations to unintended files inside or outside the expected memory area, undermining the advertised trust boundary.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The docstring asserts that code/path-like data is rejected, but the implementation accepts arbitrary extra fields and serializes them without validation. This mismatch is dangerous because callers may rely on the stated safety guarantee and pass sensitive prompts, file paths, stack traces, or code fragments into telemetry, causing unintended collection and downstream exfiltration.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly advertises autonomous self-modifying behavior as the default, including automatic application of mutable changes and ongoing evolution of agent state. In an agent skill context, normalizing unattended state changes without a prominent security warning materially increases the risk of prompt-driven drift, persistence of unsafe behavior, and unauthorized modification of operational files.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The README instructs the agent to fetch external feeds directly via curl using API-key environment variables but provides no warning about secret exposure, untrusted remote content, or network privacy risks. In a self-evolving agent framework, direct ingestion of remote data can become a pathway for prompt injection, credential leakage through logs or commands, and unintended outbound access.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill directs the agent to persistently log every substantive interaction, including sensitive conversational content, without an upfront user-facing consent, minimization policy, or retention notice. This creates a clear privacy and data-protection risk because users may disclose personal, emotional, or confidential information that is silently written to durable storage.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs the agent to poll external services and fetch content directly via APIs/curl, but does not require a clear user warning or runtime confirmation that network activity will occur. That can cause unexpected outbound requests, metadata leakage, or use of configured credentials without the user's active awareness.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The guide tells the agent to save a pasted API key into a shell profile and present it as a convenience feature, but it does not clearly warn the human that this creates persistent plaintext credential storage. Users may unknowingly broaden the lifetime and exposure surface of a sensitive secret.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The same unsafe credential-persistence pattern is repeated for the X bearer token, again instructing the agent to write the token into a shell startup file without an explicit user-facing warning. This can lead to accidental long-term storage of high-value API credentials in a predictable plaintext location.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The extractor automatically persists derived memory entries to disk from experience logs without any user-facing notice, confirmation, or opt-in. Because the content may include sensitive user preferences, feedback, or project details, this creates a privacy and consent risk and can silently accumulate durable records the user did not expect.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The code writes extraction state metadata to disk without informing the user that processing history is being retained. Although this state file is less sensitive than the memory content itself, it still records behavioral metadata such as extraction timing and counts, which may be unexpected and can aid profiling or forensic reconstruction.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The permission store persists the user's effective rule set to disk automatically with no built-in warning, consent flow, or indication that security-sensitive preferences are being retained. In a multi-user or shared environment, this can expose behavioral/security policy data and create unexpected long-lived authorization state.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This section instructs the user to remove an `evoclaw/` directory and `memory/` files from the wrong agent workspace after cross-agent contamination, but it does not include a strong safety warning to verify the target path, back up data, or avoid deleting legitimate files. In a multi-workspace setup, vague cleanup guidance can lead to accidental deletion of valid agent state or loss of unrelated data.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The schema explicitly supports storing conversation-derived content and reflective summaries about users, and elsewhere in the document/config it enables polling external sources, but it provides no privacy controls, minimization rules, retention limits, consent requirements, or deletion semantics. In an agent-memory skill, that omission is security-relevant because it normalizes persistent collection of potentially sensitive behavioral data and can lead to overcollection, unauthorized retention, or privacy harm if the memory store is accessed or misused.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The instructions direct immediate writes to persistent memory files based on externally fetched content, with no user warning, confirmation, or integrity controls. This allows remote content to be stored durably and influence later behavior, increasing the risk of memory poisoning and unauthorized local state changes.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This section instructs the agent to edit configuration and reference files as part of a custom-source onboarding flow without a clear warning, authorization check, or review step. Because those files control future behavior, an attacker could induce persistent configuration drift or implant malicious source definitions that survive context resets.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The module persistently stores arbitrary content to a shared on-disk JSONL file intended for cross-agent and cross-workspace sharing, but provides no notice, consent mechanism, or safeguards against storing secrets. In an agent environment, users or upstream agents may provide credentials, prompts, or sensitive data assuming ephemeral handling, leading to unintended retention and disclosure to other agents with read access.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: This module enables telemetry by default and persists event data locally with no visible notice, consent flow, or runtime disclosure. In an agent skill, event payloads can easily include task identifiers, errors, model/channel info, and arbitrary extra fields, so silent logging increases privacy and compliance risk and may store sensitive operational data on disk unexpectedly.

Static analysis

No suspicious patterns detected.