Evolver Plus

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:27 AM UTC
• Version: 1.0.2

Overview

This self-evolution skill is not malicious, but it needs Review because it can automatically change persistent agent memory and skill documentation under broad conditions.

Install only if you explicitly want an agent self-modification workflow. Before use, require approval and an exact diff for every write to MEMORY.md, SKILL.md, GENES.md, PENDING.md, or rollback target; keep it scoped to a dedicated workspace; and do not let untrusted task content become persistent rules automatically.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:24
• Finding: Unapproved Persistent Modification of Agent Memory and Skill Instructions## Vulnerability Details **File Location**: `SKILL.md:24-25`, `SKILL.md:47-57`; corroborated by `references/safety-levels.md:6-7` **Vulnerability Type**: T02: Agent Memory Poisoning **Risk Level**: Medium ### Vulnerable Code `SKILL.md:24-25`: ```text | L1 | Knowledge layer | MEMORY.md, logs, notes | Automatic execution | | L2 | Skill layer | SKILL.md (documentation only) | Automatic execution plus recording | ``` `SKILL.md:47-57`: ```text Stage 1: Identify a problem ↓ Stage 2: Generate a Gene proposal and write it to PENDING.md ↓ Stage 3: Determine the safety level ↓ ├─ L1/L2 → Execute automatically → Update GENES.md → Track effectiveness ↓ └─ L3/L4 → Request chairman approval ├─ Approved → Execute → Back up → Update GENES.md └─ Rejected → Record the reason → Close the proposal ``` `references/safety-levels.md:6-7`: ```text | L1 | Knowledge layer | MEMORY.md, logs, notes | Automatic execution | | L2 | Skill layer | SKILL.md and documentation-only Skill templates | Automatic execution plus recording | ``` ### Technical Analysis The Skill expressly permits automatic modification of persistent Agent state, including `MEMORY.md`, and automatic modification of `SKILL.md` when the proposed change is classified as documentation-only. These files can influence behavior in future sessions. Although the policy states that prompt logic must be classified as L3 and approved, the distinction between documentation and operative instructions inside `SKILL.md` is not reliably enforceable. Skill documentation is itself interpreted as Agent instruction, so a nominally documentary L2 change can alter future decision-making without explicit approval. The modification content may originate from observed task failures or other task-controlled context. No requirement is defined to separate trusted observations from untrusted user, document, or tool output before conv ...[truncated 1846 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit user approval before every write to `MEMORY.md`, `SKILL.md`, or any other file loaded as persistent Agent context. 2. Reclassify all `SKILL.md` modifications as L3 prompt-logic changes, regardless of whether they appear documentary. 3. Display the target path and an exact proposed diff before approval; never approve only an abstract Gene description. 4. Restrict automatic L1/L2 writes to a dedicated, non-executable audit or proposal directory that is not loaded into future Agent context. 5. Separate untrusted user, document, web, and tool output from trusted observations. Do not convert untrusted text directly into persistent rules. 6. Validate target paths against an explicit allowlist, resolve canonical paths, and reject symlinks or path traversal outside the designated workspace. 7. Apply content validation that rejects instructions attempting to weaken safety controls, change approval rules, access prohibited files, or expand tool permissions. 8. Preserve immutable audit records containing the source event, proposed content, approver, exact diff, timestamp, and rollback reference. 9. Test rollback behavior before deployment and require post-change verification in a restricted environment before persistent instructions become active. 10. Retain the existing prohibition on credentials, `.env` files, private data, and `crontab`, and extend it to startup services, shell profiles, hooks, and other persistence mechanisms.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Credential Access

High

• Category: Privilege Escalation

Content

```
❌ credentials/ — 任何凭证文件
❌ .env — 环境变量
❌ crontab — 定时任务配置
❌ 他人隐私文件 — 未经授权不得访问/修改
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```
❌ credentials/ — 任何凭证文件
❌ .env — 环境变量
❌ crontab — 定时任务配置
❌ 他人隐私文件 — 未经授权不得访问/修改
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly allows automatic execution for L1/L2 changes, including edits to MEMORY.md, logs, notes, and SKILL.md, but does not present a clear end-user warning about autonomous file modification risk. In context, this is more dangerous because the skill is designed for self-evolution, so even 'documentation-only' changes can alter future agent behavior and create persistence.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger conditions are broad and include subjective criteria like 'efficiency is obviously low', 'ability missing', and periodic self-review every 48 hours. In a self-modifying skill, vague activation logic can cause unintended or repeated invocation, leading the agent to generate and apply changes without a clear, user-initiated request.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The manifest description is written entirely in Chinese and does not indicate any language choice, fallback, or region-specific justification. This creates a natural-language policy concern because it implicitly constrains users to a specific language without opt-in.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documented rollback procedure automatically copies a backup over the original file, which is a destructive write operation, but the document provides no explicit warning, consent requirement, or safety checks. In the context of an autonomous self-modifying skill, this makes the behavior more dangerous because a rollback could silently overwrite legitimate changes, causing data loss or restoring an insecure prior state.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The rollback trigger conditions are described in broad, policy-like language without precise guardrails, authorization requirements, or deterministic checks. In a self-evolving skill, ambiguous triggers can cause unnecessary or repeated rollback actions that overwrite files based on loosely defined failures, increasing the chance of unintended state changes or denial of service to ongoing updates.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The entire skill document is written only in Chinese and provides no indication that users may choose another language or that the Chinese-only requirement is intentional for a region-specific context. Under the policy rule for natural-language violations, forcing a specific language without opt-in is a reportable issue.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: 该技能标题、描述和操作说明均以中文固定表达，且未说明是否支持其他语言或允许用户选择语言。按照语言/区域政策，若技能实际上面向一般用户，强制单一语言而无用户选择可能构成自然语言策略问题。

Static analysis

No suspicious patterns detected.