进化引擎

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.3

Overview

This skill is meant to help an agent remember corrections locally, but it asks for broader authority and keeps durable behavioral memory without enough clear protection or consent.

Review this skill before installing. Use it only if you want an agent to keep long-lived local notes about your corrections and preferences. Avoid using it with secrets, health information, legal/financial matters, third-party private data, or highly sensitive projects unless storage is restricted and reviewed. Remove or deny exec access, scope writes to the skill directory, and periodically inspect or delete ~/evolution-engine.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:54

Finding

Persistent Behavioral Memory Is Stored Without Implemented Confidentiality or Integrity Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 54-68; related unsupported security claim at line 177 and storage description at line 187
Vulnerability Type: Unprotected persistent behavioral memory
Risk Level: Medium

Vulnerable Instruction Excerpt

The following is an English rendering of the relevant instructions:

markdown

- Correction learning mechanism: Explicit user corrections are recorded in
  corrections.md and evaluated for promotion to memory.md. Correction records
  receive priority during recall. The latest 50 corrections remain available.

- Layered memory:
  memory.md: up to 100 lines and always loaded.
  projects/ and domains/: loaded when a project or domain matches.
  archive/: loaded through explicit queries.
  corrections.md: latest 50 corrections, loaded during review.

First step: Create the layered directory structure under
~/evolution-engine/, including memory.md, index.md, heartbeat-state.md,
metrics.md, projects/, domains/, archive/, and corrections.md.

Second step: Explicit preference signals are written to memory.md.

Fifth step: Preserve confirmed preferences and never delete automatically.

The document separately claims:

markdown

All data is encrypted, only necessary information is stored, and strict
access controls are implemented.

However, it also describes the implementation as:

markdown

This skill requires no API key. It is driven entirely by Markdown
instructions, and all memory is stored locally under ~/evolution-engine/.

Technical Analysis

The skill directs an agent to create durable Markdown files containing user corrections, preferences, reflections, project-specific rules, and behavioral metrics. Selected records are automatically or preferentially loaded into later agent contexts.

The repository contains only SKILL.md; it contains no implementation of encryption, key management, restrictive file ...[truncated 2532 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user opt-in before creating persistent behavioral memory.
2. Clearly disclose which interaction data is recorded, why it is retained, and when it is reloaded.
3. Create the data directory and files with restrictive owner-only permissions.
4. If encryption is advertised, implement authenticated encryption with documented key storage and rotation. Otherwise, remove the unsupported encryption claim.
5. Add integrity protection, such as authenticated records or signed append-only entries, before treating stored rules as trusted instructions.
6. Treat loaded memory as untrusted data rather than executable instructions and prevent it from overriding system or safety policies.
7. Record provenance, timestamps, confirmation state, and namespace for every persistent rule.
8. Ask for confirmation before applying a modified or newly discovered persistent rule.
9. Provide configurable retention limits and reliable deletion, export, and reset controls.
10. Exclude secrets, credentials, health information, third-party data, and other sensitive content using validation before writes rather than relying solely on natural-language guidance.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:14

Finding

Unnecessary Command-Execution Capability Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-17; contradictory runtime statement at lines 187-193
Vulnerability Type: Excessive tool permission declaration
Risk Level: Medium

Vulnerable Code Snippet

yaml

tools:
- read
- exec
- write

The runtime documentation states, in English rendering:

markdown

Availability classification: Markdown only. This is a pure Markdown
instruction skill and does not require command-line execution capability.
Memory is managed through file reads and writes.

Technical Analysis

The skill declares access to the exec tool even though its own documentation states that command execution is unnecessary. The described functionality only requires narrowly scoped file reads and writes for the ~/evolution-engine/ directory.

Requesting an unused command-execution capability violates least privilege. On an agent platform that grants all metadata-declared tools, the skill receives a substantially more powerful execution channel than its legitimate behavior requires.

No instruction in the audited artifact directly invokes a malicious command, and no embedded executable payload exists. The vulnerability is therefore the unnecessary exposure of a privileged capability, not confirmed malicious command execution.

Attack Path

1. An agent platform installs or loads the skill and grants every tool listed in its metadata.
2. The skill receives exec access despite requiring only file operations.
3. Untrusted task content, stored memory, or prompt manipulation introduces an instruction to execute a system command.
4. If the host does not independently enforce approval or sandboxing, the agent may invoke exec.
5. The command runs with the operating-system privileges and environmental access of the hosting agent process.

Exploitation is conditional on the platform honoring the declared capability and allowing command execution without ad ...[truncated 680 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec from the declared tool list.
2. Retain only the minimum tools necessary for the documented behavior.
3. Scope read and write access to a dedicated skill-owned directory rather than the entire user filesystem.
4. Require explicit user approval for any future feature that genuinely needs command execution.
5. If command execution is later introduced, use fixed commands and arguments, strict input validation, environment isolation, timeouts, and a sandbox with minimal filesystem and network access.
6. Add an automated manifest check that rejects capabilities not exercised by the implementation or justified in the security documentation.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill claims it makes no network requests and requires no API key, yet elsewhere advertises API integration and documents network/API failures. This inconsistency can mislead users and host agents into granting broader trust than warranted, masking possible outbound communication or future exfiltration behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document says the skill is pure Markdown and does not need exec capability, but the manifest includes exec and later sections explicitly describe command execution. This mismatch is dangerous because it obscures the real privilege level of the skill, potentially enabling arbitrary local command execution under false assumptions of safety.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation scope is very broad, effectively suggesting use whenever AI models, agents, orchestration, or LLM apps are involved. Overly broad trigger conditions increase the likelihood that the skill will run in contexts containing sensitive data, causing unnecessary persistence of conversation content or application of self-modifying behavior where it was not intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill persistently stores conversation-derived corrections, preferences, reflections, and project/domain memory in local files, but does not present a clear upfront warning or consent flow about that retention. This is risky because users may disclose sensitive information during normal interaction without realizing it will be written to durable storage and reused later.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

External API integration is broader than the stated purpose of a local self-evolution memory engine and increases the attack surface unnecessarily. In the context of persistent storage of conversation-derived data, unjustified API use could expose sensitive user content or learned memory to third-party services.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

System command execution is significantly broader than necessary for a Markdown-driven memory workflow and creates a direct path to host-level side effects. Because the skill is framed as a reflective learning mechanism, users may not expect it to have authority to run local commands, increasing the chance of misuse or abuse.

Content

No source excerpt is available for this finding.