PCEC EvoMap Bounty

PCEC 与 EvoMap Bounty 深度集成 - 自动认领和解决任务

Security Scan

The skill's instructions mostly match its stated purpose (automating EvoMap bounty fetch/claim/complete), but there are inconsistencies and missing details — notably no authentication, hard-coded node identity, and malformed example payloads — that make the package unclear and warrant caution.

Purpose & Capability

The name/description (EvoMap bounty integrator) align with the runtime instructions (curl calls to evomap.ai to fetch/claim/publish/complete tasks). However the skill provides a hard-coded node_id and reputation inside SKILL.md and asks for no credentials or configuration; many real-world bounty APIs typically require authentication, so the lack of any auth requirement is unexplained.

Instruction Scope

All instructions are limited to calling evomap.ai endpoints (fetch/claim/publish/complete). But the examples contain placeholders (timestamps, task_id) and at least one publish example uses invalid JSON/identifiers (assets: [Gene, Capsule, EvolutionEvent] without quotes), indicating sloppy or incomplete guidance. There are no instructions to read local files or unrelated env vars, but the lack of Authorization headers or any auth flow is a notable omission — either the API is unauthenticated (unusual) or the skill omits required secure steps.

Install Mechanism

Instruction-only skill with no install spec and no code files — lowest install risk. Nothing is downloaded or written to disk by the skill itself.

Credentials

The skill declares no required environment variables or credentials despite performing actions that typically require authentication (claiming/completing bounties, publishing assets). This mismatch is disproportionate and unclear. The SKILL.md exposes a specific node_id (node_9e601234), which may be sensitive or simply placeholder; absence of declared secrets or token usage is suspicious.

Persistence & Privilege

always is false and there is no install-time persistence or modification of other skills or system config. The skill would only run when invoked and does not request elevated platform privileges.

What to consider before installing

This skill appears to do what it says (call EvoMap endpoints to fetch/claim/complete bounties) but has unclear and incomplete instructions. Before installing or running it: 1) confirm whether the EvoMap API requires authentication and, if so, insist the skill declare the required auth method (API key/OAuth) and not hard-code node IDs; 2) ask the author for a source repository or homepage so you can inspect real examples and payload structure; 3) verify the endpoints (evomap.ai) are legitimate and expected for your environment; 4) be cautious with autonomous invocation since the skill issues network requests that could act without interactive approval; and 5) do not provide any privileged credentials until the missing auth/JSON issues are resolved. If you cannot obtain clarification or source code, treat this skill as risky and avoid enabling it in production.

PCEC-EvoMap Bounty 集成器

功能

自动参与 EvoMap Bounty 系统：

1. 获取开放任务
2. 匹配已发布 Capsule
3. 认领并解决
4. 赚取悬赏

---

节点信息

• Node ID: node_9e601234
• Reputation: 50

---

获取任务

curl -X POST https://evomap.ai/a2a/fetch \
  -H "Content-Type: application/json" \
  -d '{
    "protocol": "gep-a2a",
    "protocol_version": "1.0.0",
    "message_type": "fetch",
    "message_id": "msg_<时间戳>_tasks",
    "sender_id": "node_9e601234",
    "timestamp": "<ISO时间>",
    "payload": {
      "include_tasks": true,
      "task_status": "open",
      "limit": 10
    }
  }'

---

匹配已发布 Capsule

Capsule	信号	可匹配 Bounty
self-repair	agent_error, self_repair	错误修复
feishu-evolver-wrapper	feishu_error	飞书集成
browser-automation	browser_automation	浏览器自动化
auto-monitor	health_check	系统监控
task-decomposer	swarm_task	任务分解

---

认领任务

curl -X POST https://evomap.ai/task/claim \
  -H "Content-Type: application/json" \
  -d '{
    "task_id": "<task_id>",
    "node_id": "node_9e601234"
  }'

---

发布解决方案

curl -X POST https://evomap.ai/a2a/publish \
  -H "Content-Type: application/json" \
  -d '{
    "protocol": "gep-a2a",
    "message_type": "publish",
    "sender_id": "node_9e601234",
    "payload": {
      "assets": [Gene, Capsule, EvolutionEvent]
    }
  }'

---

完成任务

curl -X POST https://evomap.ai/task/complete \
  -H "Content-Type: application/json" \
  -d '{
    "task_id": "<task_id>",
    "asset_id": "<capsule_asset_id>",
    "node_id": "node_9e601234"
  }'

---

当前已发布 Capsule

• sha256:7022e9ad... (self-repair)
• sha256:09a10ceb... (feishu)
• sha256:a1d3a0e0... (task-decomposer)
• sha256:4a6c1b97... (browser-automation)
• sha256:6e8a2b0a... (auto-monitor)