Hydra Evolver

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:34 AM UTC
• Version: 1.0.0

Overview

This home-lab orchestration skill is not clearly malware, but it can scan, provision, and alter machines with insufficient guardrails.

Install only if you intentionally want an agent involved in managing your own home-lab infrastructure. Review and preferably rewrite the provisioning script before running it, avoid unattended mesh_provision execution, use least-privilege Proxmox tokens, restrict scans to systems you own, and treat the hardening claims as unverified.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill advertises infrastructure orchestration behaviors including network scanning, deployment, file reading, and shell-driven provisioning, yet declares no permissions. That mismatch prevents informed consent and weakens any permission boundary the host system may rely on, especially for a skill that can touch local files and execute system commands.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose presents a Proxmox-native orchestration tool, but the described behavior includes broader host provisioning, remote-access installation, local project-file inspection, and network reconnaissance that are not clearly tied to Proxmox management. This kind of description-behavior mismatch is dangerous because it can mislead users into authorizing a much more invasive skill than they intended.

Intent-Code Divergence

Medium

• Confidence: 76% confidence
• Finding: Labeling the process as 'hardened onboarding' can create false operator confidence while the script performs insecure remote bootstrap actions. In security-sensitive provisioning, misleading assurance language increases the chance administrators run the script without scrutiny, amplifying the risk of the underlying unsafe behaviors.

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: The skill does not clearly define when it should be invoked, what user intent is required, or what preconditions must be met before it scans networks or provisions nodes. Ambiguous activation scope increases the chance that an agent will invoke powerful infrastructure actions in the wrong context or without sufficiently specific user authorization.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The skill description omits clear warnings that it may autonomously manage infrastructure, deploy agents to other machines, read local project state files, and potentially modify operational environments. For a skill with remote deployment and shell/provisioning implications, lack of prominent warnings undermines informed consent and raises the risk of unexpected lateral movement or system changes.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script downloads and immediately executes a remote Docker installer with root privileges via curl-pipe-to-shell. If the remote endpoint, TLS trust chain, DNS, or upstream script is compromised, arbitrary code will run on the host without inspection or user confirmation.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The Tailscale installer is fetched and executed directly from the network without review, pinning, or confirmation. Because Tailscale modifies networking and may establish remote connectivity paths, compromise of the install path could yield immediate privileged code execution and expanded remote access exposure.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: A global npm install modifies the system-wide runtime environment and executes package lifecycle scripts, potentially as root in provisioning contexts. If the package or one of its dependencies is malicious or compromised, this can result in arbitrary code execution and persistent supply-chain compromise.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script performs unauthenticated network probing of multiple internal IPs by attempting TCP connections to SSH and a custom service port, effectively implementing port scanning behavior without any user notice, consent flow, scope validation, or access controls. In an orchestration skill, this can enable unauthorized network reconnaissance, expose internal topology, and violate least-privilege expectations, especially if run automatically in a home lab or shared environment.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

The Hydra Mesh Evolver is a specialized skill for the OpenClaw Mesh. It allows an agent to autonomously manage, monitor, and evolve a distributed cluster of worker nodes.

## Features
- **Node Injection:** Automatically deploy OpenClaw agents to Windows, Mac, and Linux nodes.
- **Proxmox Telemetry:** Real-time hardware health and VM management.
- **Self-Evolution Loop:** Scans project files (`PROJECTS.md`) and proposes code fixes/resume-plans for stalled work.
- **ZeroLeaks Hardened:** Built-in boundaries to prevent prompt injection during web research.

• Confidence: 81% confidence
• Finding: Automatically deploy

External Script Fetching

Low

• Category: Supply Chain

Content

# 2. Docker
if ! command -v docker >/dev/null 2>&1; then
    log "Installing Docker..."
    curl -fsSL https://get.docker.com | sh
    usermod -aG docker $SUDO_USER
else
    log "Docker already installed."

• Confidence: 98% confidence
• Finding: curl -fsSL https://get.docker.com | sh

External Script Fetching

High

• Category: Supply Chain

Content

# 3. Node/NPM (via Volta for stability)
if ! command -v node >/dev/null 2>&1; then
    log "Installing Node.js via Volta..."
    curl https://get.volta.sh | bash
    export VOLTA_HOME="$HOME/.volta"
    export PATH="$VOLTA_HOME/bin:$PATH"
    volta install node@22

• Confidence: 97% confidence
• Finding: curl https://get.volta.sh | bash

External Script Fetching

High

• Category: Supply Chain

Content

# 4. Tailscale
if ! command -v tailscale >/dev/null 2>&1; then
    log "Installing Tailscale..."
    curl -fsSL https://tailscale.com/install.sh | sh
else
    log "Tailscale already installed."
fi

• Confidence: 99% confidence
• Finding: curl -fsSL https://tailscale.com/install.sh | sh

Chaining Abuse

High

• Category: Tool Misuse

Content

# 2. Docker
if ! command -v docker >/dev/null 2>&1; then
    log "Installing Docker..."
    curl -fsSL https://get.docker.com | sh
    usermod -aG docker $SUDO_USER
else
    log "Docker already installed."

• Confidence: 99% confidence
• Finding: | sh

Chaining Abuse

High

• Category: Tool Misuse

Content

# 3. Node/NPM (via Volta for stability)
if ! command -v node >/dev/null 2>&1; then
    log "Installing Node.js via Volta..."
    curl https://get.volta.sh | bash
    export VOLTA_HOME="$HOME/.volta"
    export PATH="$VOLTA_HOME/bin:$PATH"
    volta install node@22

• Confidence: 99% confidence
• Finding: | bash

Chaining Abuse

High

• Category: Tool Misuse

Content

# 4. Tailscale
if ! command -v tailscale >/dev/null 2>&1; then
    log "Installing Tailscale..."
    curl -fsSL https://tailscale.com/install.sh | sh
else
    log "Tailscale already installed."
fi

• Confidence: 99% confidence
• Finding: | sh

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.