Sevo Pipeline

SEVO — Agent 研发流水线。Spec-Execute-Verify-Operate: the agentic software delivery lifecycle for AI agent software production. Covers 8 stages from specification...

Security Scan

The package looks like a legitimate OpenClaw / SEVO pipeline plugin and mostly does what its README/SKILL.md say, but there are several mismatches and risky behaviors (prompt injection, dynamic module imports, file-system access) that you should understand before installing.

Purpose & Capability

The name/description (SEVO pipeline) align with the large codebase and the OpenClaw integration described in the docs. However, registry metadata claimed "instruction-only / no install spec / no required env vars", while the bundle contains a full plugin implementation (bridge, index, adapters, web UI) that expects to be installed into an OpenClaw host workspace. The presence of adapter/bridge code, state files, and task-mapper is coherent with being an OpenClaw plugin — but the metadata underreports that footprint.

Instruction Scope

SKILL.md and architecture docs explicitly instruct the plugin to hook into OpenClaw events (subagent_ended, before_tool_call, before_prompt_build), inject context into the main session, parse/emit labels like sevo:<pipelineId>:<stageId>, and persist runtime state (state/active-pipelines.json). That scope requires reading/writing host workspace files and injecting prompts into the host session — behaviors beyond a simple helper. Prompt-injection to trigger spawns is an architectural choice (documented), but it increases risk because it depends on the main session/model obeying injected text and the plugin can influence host actions.

Install Mechanism

There is no external download URL or installer in registry metadata (lower network risk). The code is packaged in the skill bundle itself (many source files and web UI). That is safer than remote fetches, but it means the plugin will place and execute JavaScript on the host. The bridge dynamically imports compiled modules from a local workspace/dist path (dynamic import of local files), so the host will execute code taken from workspace/dist at runtime.

Credentials

Declared requirements list no env vars or config paths, but the code reads several environment variables and resolves workspace/sevo paths (e.g., OPENCLAW_WORKSPACE_ROOT, OPENCLAW_SEVO_DIST, OPENCLAW_SEVO_CACHE_TTL_MS, SEVO_PROJECT_ROOT). The plugin expects access to the host file system (workspace, data, dist) and will persist state under its state directory. No explicit secret/env requirements are declared in metadata, yet the code will read process.env variables if present — this is a mismatch and reduces transparency about what the plugin can access.

Persistence & Privilege

The plugin persists runtime state (state/active-pipelines.json), reads/writes pipeline state under a workspace data path, and dynamically imports local compiled modules to execute pipeline logic. It does not set always:true and does not claim force-privileges, but its capability to inject prompts into the main session and to persist/execute files gives it significant influence over host behavior. The docs state fail-open behavior, but fail-open combined with auto-advance prompt injection means misconfiguration or malicious modification of workspace/dist could cause undesired automated actions.

What to consider before installing

What to consider before installing: - This package is a full OpenClaw plugin (not just a tiny instruction). It expects to be installed into the host workspace and will read/write files there (pipeline state, events, possibly project artifacts). Review where it will be placed (typical path: ~/.openclaw/extensions/sevo-pipeline and ~/.openclaw/workspace). - The plugin injects text into the main session (before_prompt_build) to request that the host spawn subagents; it deliberately uses prompt injection (documented ADR). That is a design choice: it avoids directly calling spawn APIs but relies on the main session/model to obey the injected instructions. If you run in a sensitive environment, this increases risk — a model could be coerced or misled by injected content. Consider running in a sandboxed host first. - The bridge dynamically imports compiled JS from the workspace/dist path and constructs/instantiates engine classes at runtime. That means code present under the workspace can be executed with plugin privileges. Make sure the workspace and any dist artifacts are trusted and immutable (or verify builds) before enabling. - Metadata underreports the footprint (no required env vars/config paths declared), but the code reads env vars and resolves config paths. Expect to configure OPENCLAW_WORKSPACE_ROOT / OPENCLAW_SEVO_* or confirm default locations. Confirm there are no unexpected env variables or secrets in those paths. - Recommended actions: (1) review the included source (bridge.js, index.js, label-protocol.js, task-mapper.js, and the hooks) to ensure behavior matches policy; (2) install and test in an isolated OpenClaw sandbox environment first; (3) ensure no secrets are present in the target workspace; (4) consider pinning/locking the dist compiled artifacts or running sevo build steps yourself and auditing the resulting JS; (5) if you don't want automatic prompt-driven spawning, disable or override the before_prompt_build hook or run in Single-Agent Mode with manual approval. Confidence note: The assessment is based on code and SKILL.md provided. If you can provide the OpenClaw host policy, exact installation path, and any intended env var overrides, I can raise or lower concern levels — e.g., if you plan to install into a disposable test host the risk is lower.

SEVO — Agent 研发流水线

Spec-Execute-Verify-Operate: the agentic software delivery lifecycle.

What is SEVO?

SEVO is the execution infrastructure module of the Self-Evolving Harness framework. It governs the full AI agent software delivery lifecycle through 8 stages:

1. Spec — Requirements specification and conceptual architecture
2. Contract — Architecture design, ADRs, and gate checks
3. Implement — Code generation with real-time quality interception
4. Review — Independent code audit and security review
5. Regression — Dry-run, local install, and smoke testing
6. Deploy — Artifact packaging and publication
7. Verify — Clean-environment installation and end-to-end validation
8. Ledger — Delivery record with version, date, spec, architecture, audit trail, and experience write-back

Why SEVO?

Current AI coding agents cover the middle stages (implement → deploy) well, but lack front-end constraints (spec, contract) and back-end closure (verify, ledger). SEVO fills both gaps, making agent software production auditable, reproducible, and self-improving.

Integration

• KIVO feeds knowledge and intent routing into SEVO
• SEVO execution produces decisions, experiences, and corrections that flow back to KIVO
• AEO measures agent effectiveness within SEVO and triggers evolution when drift is detected

Status

Early stage. Being stress-tested through real SDD projects (Claw Design as first end-to-end run).

Author

[e-mail]