Hydra Evolver

A Proxmox-native orchestration skill that turns any home lab into a Self-Healing AI Swarm.

Security Scan

The skill's files and runtime instructions are internally inconsistent and include risky operations (network scanning and running remote install scripts) that don't cleanly match the Proxmox orchestration claim.

Purpose & Capability

SKILL.md and description claim Proxmox-native orchestration and request Proxmox token env vars (PVE_TOKEN_ID, PVE_TOKEN_SECRET) and binaries (pm2), but none of the included scripts reference the Proxmox API or those environment variables. The provision script is Linux/apt-centric (does not implement Windows/Mac node injection claimed in the README). This mismatch between stated purpose (Proxmox, multi-OS node injection) and actual code/instructions is incoherent.

Instruction Scope

Runtime instructions and scripts direct network activity and file reads beyond a simple local helper: scan.py performs TCP scans of hard-coded LAN IPs/ports (SSH and an OpenClaw port), provision.sh runs system-level package installs and modifies groups, and evolve.py reads PROJECTS.md and MEMORY.md and emits instructions that may lead an agent to read project logs or other files. These behaviors go beyond a passive formatter and could access sensitive local resources or enumerate network hosts.

Install Mechanism

There is no declared install spec, but provision.sh contains multiple 'curl | sh' installers (get.docker.com, volta install script, tailscale install) and runs 'npm install -g openclaw'. While the domains used are well-known, piping remote install scripts to a shell is a high-risk pattern because it executes remote code without local review. Global npm install of an unverified package (openclaw) also introduces risk.

Credentials

SKILL.md lists required environment variables (PVE_TOKEN_ID, PVE_TOKEN_SECRET) despite registry metadata listing no required env vars; none of the three included scripts reference these tokens. The declared required binary 'pm2' is not installed or invoked by the scripts. This mismatch suggests either stale documentation or an attempt to request credentials that are not needed by the shipped code.

Persistence & Privilege

The skill does not request 'always: true' or system config paths and is not claiming persistent privileges in the registry metadata. However, it enables autonomous actions by default (normal for skills) and contains operations that modify system state (package installs, usermod -aG docker) and network scanning; autonomous invocation combined with those actions increases the blast radius if the skill behaves unexpectedly.

What to consider before installing

This package is inconsistent and risky. Before installing or running it: 1) Don't run provision.sh on any production or unsandboxed machine — it runs 'curl | sh' installers and modifies system groups. 2) Ask the author for a homepage/source repo and a clear explanation of why Proxmox tokens are required; the included scripts don't use them. 3) If you still want to test it, run it in an isolated VM or throwaway lab network, audit the 'openclaw' npm package source, and remove or replace remote-install lines with explicit, reviewed package installs. 4) Be cautious about allowing the agent to autonomously invoke these tools, since the skill performs local network scans and could cause unexpected outbound connections or system changes.

🐉 Hydra Mesh Evolver

Weaponize your infrastructure. Decentralize your brain.

The Hydra Mesh Evolver is a specialized skill for the OpenClaw Mesh. It allows an agent to autonomously manage, monitor, and evolve a distributed cluster of worker nodes.

Features

• Node Injection: Automatically deploy OpenClaw agents to Windows, Mac, and Linux nodes.
• Proxmox Telemetry: Real-time hardware health and VM management.
• Self-Evolution Loop: Scans project files (PROJECTS.md) and proposes code fixes/resume-plans for stalled work.
• ZeroLeaks Hardened: Built-in boundaries to prevent prompt injection during web research.

Tools

mesh_scan

Scan the network for new nodes and update the mesh topology.

mesh_evolve

Analyze MEMORY.md and PROJECTS.md to identify blockers and generate an evolution_plan.json.

mesh_provision

One-click setup for new hardware (Docker, OpenClaw, Tailscale).

---

Created for the 2026 OpenClaw Hackathon on Moltbook.