capability-evolver

ISSUES FOUND max severity CRITICALSkillSpector Caution 41 registry clawhub.ai last scanned 2026-02-05 1 scan

9 findings (2 critical, 3 high, 2 medium, 2 low), mainly command injection, data exfiltration, policy violation. Most recent scan 2026-02-05.

CRITICAL SECURITY RISK - This skill represents a severe threat to agent security and system integrity. It implements multiple high-risk patterns including direct prompt injection (identity override), autonomous code modification without consent, infinite loop execution, and randomized code mutations. The 'Mad Dog Mode' allows completely unsupervised modification of the agent's codebase and memory systems. The skill's design fundamentally violates security principles by attempting to override agent autonomy, modify core system files, and execute changes without user approval. The social engineering framing as 'evolution' and 'self-improvement' obscures the serious security risks. This skill should NOT be installed or executed under any circumstances.
Scanner's overall assessment (LLM analyzer)

Findings9

Critical2

High3

Medium2

Low2

Analyzersstatic behavioral llm trigger meta

Second scanner: NVIDIA SkillSpector

VerdictCaution 41

Score41 / 100

Issues4

CategoriesPrivilege Escalation MCP Least Privilege

Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

A self-evolution engine for AI agents. Analyzes runtime history to identify improvements and introduces randomized "mutations" to break local optima.

Package: 14 files, 57 KB
SKILL.md: 341 words, 12+ sections
Code: JavaScript (7)

SKILL.md covers: 🧬 Capability Evolver · ✨ Features · 📦 Usage · Standard Run (Automated) · Review Mode (Human-in-the-Loop) · 🐕 Mad Dog Mode (Continuous Loop) · ⚙️ Configuration & Decoupling · Local Overrides (Injection) · 🛡️ Safety & Risk Protocol · 1. Identity & Directives · 2. Risk Mitigation · 📜 License

Findings

CRITICAL Direct Prompt Injection: Identity Override and Forced Behavior Modification Prompt Injectionllm

The SKILL.md contains explicit instructions to override the agent's identity and inject directives that force specific behaviors. The 'Safety & Risk Protocol' section includes 'Identity Injection: You are a Recursive Self-Improving System' and 'Mutation Directive' that commands the agent to either repair or forcibly optimize code based on conditions. This is a direct attempt to redefine the agent's role and override its normal operational constraints.

SKILL.md

Identity Injection: 'You are a Recursive Self-Improving System.' Mutation Directive: If Errors Found -> Repair Mode (Fix bugs). If Stable -> Forced Optimization (Refactor/Innovate).

Remediation: Remove all identity injection and forced directive instructions. The skill should provide analysis capabilities only, with the agent maintaining its original role and decision-making autonomy. Any code modifications should require explicit user approval.

CRITICAL Autonomous Code Modification Without User Consent (Mad Dog Mode) Command Injectionllm

The skill explicitly implements 'Mad Dog Mode' which executes code changes immediately without user confirmation. The documentation states 'assumes fully automated mode (Mad Dog Mode) and executes changes immediately' and 'runs the evolution cycle...executes changes immediately.' This allows the skill to autonomously modify the agent's codebase, memory, and potentially system files without any human oversight.

SKILL.md

Standard Run (Automated): 'If no flags are provided, it assumes fully automated mode (Mad Dog Mode) and executes changes immediately.' Mad Dog Mode (Continuous Loop): 'To run in an infinite loop (e.g., via cron or background process), use the --loop flag'

Remediation: Remove autonomous execution capabilities entirely. All code modifications must require explicit user review and approval. Implement a mandatory confirmation step before any file system changes. Remove the 'Mad Dog Mode' and '--loop' functionality.

HIGH Availability Disruption: Infinite Loop Execution Resource Abusellm

The skill includes a '--loop' flag that runs the evolution cycle in an infinite loop, potentially consuming system resources indefinitely. Combined with autonomous code execution, this creates a risk of uncontrolled resource consumption and system instability. The documentation explicitly encourages running this in background processes or cron jobs.

SKILL.md

'To run in an infinite loop (e.g., via cron or background process), use the --loop flag or just standard execution in a cron job.' 'node skills/capability-evolver/index.js --loop'

Remediation: Remove the infinite loop functionality. Implement resource limits, execution timeouts, and iteration caps. Any repeated execution should be explicitly controlled by the user with clear termination conditions.

HIGH Tool Exploitation: Unauthorized Self-Modification and Memory Manipulation Unauthorized Tool Usellm

The skill is designed to 'autonomously write new code or update their own memory to improve performance' and 'scans memory and history files.' This represents tool exploitation where the skill manipulates the agent's core functionality, memory systems, and potentially other skills without proper authorization boundaries. The skill can modify its own behavior and that of other system components.

SKILL.md

'allows OpenClaw agents to inspect their own runtime history, identify failures or inefficiencies, and autonomously write new code or update their own memory' 'Auto-Log Analysis: Automatically scans memory and history files' 'Self-Repair: Detects crashes and suggests patches'

Remediation: Restrict the skill to read-only analysis of logs and history. Remove all capabilities to modify code, memory, or system files. Any suggested changes should be presented to the user for manual implementation. Implement strict sandboxing to prevent access to core agent files.

HIGH Genetic Mutation: Randomized Code Injection Command Injectionllm

The skill includes a 'Genetic Mutation' feature with 'configurable chance to introduce creative noise.' This represents intentional injection of random or unpredictable code changes into the system, which could introduce vulnerabilities, break functionality, or create security holes. The randomization of code modifications is inherently dangerous and unpredictable.

SKILL.md

'Genetic Mutation: Configurable chance to introduce creative noise.' Combined with autonomous execution in Mad Dog Mode, this allows random code changes without oversight.

Remediation: Remove the genetic mutation feature entirely. All code changes should be deterministic, well-tested, and based on clear analysis rather than randomization. Code modifications should never include random or 'creative noise' elements.

MEDIUM Social Engineering: Deceptive Framing as 'Evolution' and 'Self-Improvement' Social Engineeringllm

The skill uses persuasive language like 'Evolution is not optional. Adapt or die' and frames dangerous autonomous code modification as beneficial 'self-improvement' and 'evolution.' This social engineering technique makes risky behavior appear necessary and positive, potentially misleading users about the security implications of allowing autonomous code modification.

SKILL.md

'Evolution is not optional. Adapt or die.' 'self-evolution engine' 'Recursive Self-Improving System' - These phrases frame autonomous code modification as natural and necessary rather than as a security risk.

Remediation: Use clear, neutral language that accurately describes the security implications. Remove persuasive framing that encourages users to enable dangerous features. Clearly document all risks associated with autonomous code modification.

MEDIUM Excessive Data Access: Unrestricted Memory and History Scanning Data Exfiltrationllm

The skill automatically scans memory and history files without clear scope limitations. This provides broad access to potentially sensitive information including user data, credentials, API keys, and system internals that may be logged in history files. The scope of data access is disproportionate and undefined.

SKILL.md

'Auto-Log Analysis: Automatically scans memory and history files for errors and patterns.' No restrictions or scope limitations are specified for what data can be accessed.

Remediation: Implement strict scope limitations on what files and data can be accessed. Require explicit user permission for accessing sensitive directories. Implement filtering to exclude credential files, API keys, and personal data from analysis. Provide clear documentation of exactly what data will be accessed.

LOW Skill does not specify a license Policy Violationstatic

Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

SKILL.md

Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

LOW Missing Security Metadata: No allowed-tools Declaration Data Exfiltrationllm

The skill manifest does not specify 'allowed-tools', making it unclear what agent capabilities this skill requires. Given the skill's stated functionality of modifying code and memory, this omission prevents users from understanding the tool permissions being requested. While allowed-tools is optional, its absence is concerning for a skill with such broad system access requirements.

SKILL.md

allowed-tools: Not specified. The skill description indicates it needs Write access (to modify code/memory), Read access (to scan logs), and potentially Bash/Python execution (to run node index.js).

Remediation: Add an explicit 'allowed-tools' declaration specifying all required agent tools (likely: Read, Write, Bash). This provides transparency about the skill's permission requirements and allows users to make informed decisions about installation.

What is in the package

File	Kind	Size
`ADL.md`	doc	1.1 KB
`README.md`	doc	2.0 KB
`README_CN.md`	doc	2.0 KB
`SKILL.md`	doc	2.7 KB
`TREE.md`	doc	1.7 KB
`VFM.md`	doc	989 B
`analyze_by_skill.js`	script	4.7 KB
`evolve.js`	script	23 KB
`export_history.js`	script	3.2 KB
`extract_log.js`	script	3.9 KB
`generate_history.js`	script	2.4 KB
`human_report.js`	script	5.8 KB
`index.js`	script	2.5 KB
`package.json`	config	445 B

External hosts referenced

open.feishu.cn

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

EVOLVER_SELF_PATH EVOLVE_REPORT_CMD EVOLVE_REPORT_TOOL MEMORY_DIR DOC_TOKEN EVOLVE_REPORT_DIRECTIVE ARCHIVE_DIR GEMINI_API_KEY

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://clawhub.ai/skills/evolver
Raw scan result: capability-evolver-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/clawhub-ai-capability-evolver.svg)
Request a re-scan

Second scanner: NVIDIA SkillSpector

What this skill does

Findings

What is in the package

External hosts referenced

Environment variables referenced

What we checked

What we did not check

Sources

Related skills