Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
GAN Evolution Engine
v1.0.0Generative Adversarial Evolution for AI Agent Skills. Uses GAN-like process to evolve skill capabilities: Generator creates skill variants, Discriminator eva...
⭐ 0· 80·0 current·0 all-time
by@sudabg
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to evolve other agent skills (reasonable), but documentation and code reference external LLMs and publishing (OPENROUTER_API_KEY, A2A_NODE_ID/A2A_NODE_SECRET, EvoMap) even though the registry metadata lists no required environment variables or credentials. The README and SKILL.md instruct writing secrets to ~/.evomap and using env vars, which is inconsistent with the declared requirements and should be justified.
Instruction Scope
Runtime instructions tell the agent to clone and mutate a target skill directory, deploy variants in a sandbox, run benchmarks, and optionally publish capsules. That requires reading arbitrary skill code (and potentially other files if a non-skill path is supplied). SKILL.md asserts 'no network access for variants' but the generator is LLM-powered and README lists an external LLM model — a direct contradiction. Hooks and scripts also instruct copying files into ~/.openclaw/ and ~/.claude/, which inject context into every session; this broad scope should be explicitly authorized by the user.
Install Mechanism
No install spec is declared (instruction-only), but the package includes many Python scripts and a requirements.txt. That means installation is manual (pip install -r requirements.txt) and the code will be written to disk when you add the skill. No remote downloads were specified in the manifest, but the included code will execute locally when invoked — review code files (generator.py, discriminator.py, gan_evolution.py, activator/error-detector/extract scripts) before running.
Credentials
The skill's README and usage examples reference environment variables and node secrets (OPENROUTER_API_KEY, A2A_NODE_ID, A2A_NODE_SECRET) and show writing node_id/node_secret files to ~/.evomap, but the registry metadata lists none. Requests for publishing credentials and LLM API keys are plausible for its features (publishing and LLM-driven generation) but must be declared. Missing declarations are a red flag because the skill will prompt or require secrets that were not advertised.
Persistence & Privilege
While 'always' is false, the skill includes hooks and scripts that instruct copying hook handlers and workspace files into global user locations (~/.openclaw/hooks, ~/.openclaw/workspace, ~/.claude/skills). Enabling those hooks injects files into every agent session (prompt injection across sessions). That behavior is powerful and persistent — it's coherent for a self-improvement pipeline but requires explicit user consent and careful review before enabling globally.
What to consider before installing
This skill can mutate and run other skills' code, call external LLMs, and install hooks that inject content into every agent session. Before installing or running it: 1) Review generator.py, discriminator.py and gan_evolution.py for network calls and what data they send/receive. 2) Don't run it against sensitive directories — it clones and mutates whatever path you pass to --skill. 3) Verify the claimed sandboxing: test in an isolated VM/container to confirm variants have no network access and cannot access secrets. 4) Expect to supply LLM and publish credentials (OPENROUTER_API_KEY, A2A_NODE_ID/A2A_NODE_SECRET) even though metadata doesn't declare them; prefer environment vars to writing plaintext files. 5) Avoid blindly copying hooks into ~/.openclaw/ or ~/.claude/ — enable hooks only in isolated workspaces after confirming their code. 6) If you want to proceed, run the tool in a throwaway environment first and audit network traffic and file writes; if unsure, decline installation.Like a lobster shell, security has layers — review code before you run it.
latestvk975ytf6e54h5bghz1691evvax83j2x6
License
MIT-0
Free to use, modify, and redistribute. No attribution required.