Security audit

进化引擎

Security checks for vulnerabilities and agentic risk

Overview

The skill mainly describes a local memory system, but it asks for and advertises broader command and network-related capabilities that do not fit that purpose.

Review this skill before installing. Its local memory behavior is understandable, but it should not need exec access or network/API capability unless the publisher clearly explains why. Install only if you are comfortable with persistent records being written under ~/evolution-engine/ and can restrict or ignore the extra command/network-related permissions.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The skill claims it is purely local, requires no API key, and makes no network requests, yet other sections document external API behavior and network-related failure modes. This kind of contradiction is dangerous because operators may grant trust, lower monitoring, or approve execution under false assumptions, enabling unexpected outbound communication or data exposure.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The document says the skill is Markdown-only and does not require exec capability, but the manifest includes exec and later sections advertise command execution. This mismatch can cause an agent platform or user to enable a stronger permission set than expected, increasing the risk of arbitrary local command execution under misleading documentation.

Description-Behavior Mismatch

Medium

Confidence: 83% confidence
Finding: The skill is presented as a local self-evolution memory engine, but elsewhere it claims unrelated API integration and command execution features. That scope drift is risky because it obscures the true attack surface and can hide higher-risk capabilities behind an innocuous description.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: External API/service integration is not justified by the stated purpose of local memory evolution. Unnecessary network capability expands the attack surface, can introduce data exfiltration paths, and violates the principle of least privilege for a skill that should function locally.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Command execution is unjustified for a memory-management skill whose documented behavior is file-based learning and recall. Unneeded exec access materially raises risk because any prompt-injection or logic error could translate into local system command execution.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The Markdown describes file writes, command execution, and external API/service use without strong, prominent warnings about system impact or data exposure. When a skill can modify files, run commands, or contact services, insufficient warnings increase the chance that users or orchestrators authorize risky actions without informed consent.

Static analysis

No suspicious patterns detected.