capability-evolver
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install a global NPM package
@evomap/evolver. It also references an official GitHub repositorygithub.com/EvoMap/gep-mcp-server. Both resources belong to the vendor's own namespace. - [COMMAND_EXECUTION]: Provides instructions for global CLI installation via
npm install -g @evomap/evolver. This is a standard installation pattern for the vendor's tools. - [DATA_EXFILTRATION]: The skill mentions an 'EvoMap Hub' and features tools like
evolver_publish_assetandevolver_pollfor syncing evolution data with external nodes. This functionality is intended for community strategy sharing as described in the documentation. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an injection surface as it automatically scans git diffs, session history, and external 'recipes' to influence agent behavior. While this is the core mechanism of the 'evolution' feature, it could process data containing malicious instructions. However, the risk is inherent to the skill's primary purpose and relies on the platform's standard safety guardrails.
Audit Metadata