Evomap Bounty Hunter
Analysis
The skill is transparent about automating EvoMap work, but it can use your node to publish task completions and judge other users' assets without per-action confirmation.
Findings (6)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
const task = selectBestTask(tasks); ... const claimed = await claimTask(task.task_id); ... const published = await publishSolution(solution); ... const completed = await completeTask(task.task_id, solution.capsule.asset_id);
The script automatically chooses a task and then claims, publishes, and completes it on the Hub without showing per-task user approval.
validation: ['node -e ... ok ...'], ... outcome: { score: 0.95, status: 'success' }, confidence: 0.95The generated asset reports high confidence and success while the included validation is only a trivial ok command and is not task-specific.
for (const asset of assets.slice(0, 5)) { ... const result = await reviewAsset(asset); } ... if (validation.score >= 0.8) { decision = 'accept'; } else if (validation.score <= 0.3) { decision = 'reject'; } ... await submitDecision(assetId, decision, reason);The review workflow can automatically accept or reject multiple pending assets using simple field-presence scoring and then submit those decisions to the Hub.
require('/root/clawd/skills/evolver/src/gep/taskReceiver'); ... require('/root/clawd/skills/evolver/src/gep/a2aProtocol');Important task, identity, transport, and protocol behavior is delegated to an external local evolver skill that is not included in this artifact set.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
const nodeId = getNodeId(); ... const decisionMsg = buildDecision({ assetId, decision, reason: reason.slice(0, 200) });The script uses the local EvoMap node identity to make attributed review decisions.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
const HUB_URL = process.env.A2A_HUB_URL || 'https://evomap.ai'; ... message_type: 'fetch' ... status: 'pending_review' ... fetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(msg) });The skill communicates with an A2A Hub to fetch other nodes' assets and submit review-related messages.