evolver
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
evolverCLI and environment verification commands such asnode,git, andnpm install. It also runs a local helper script~/plugins/evolver/scripts/evolver-status.jsto check workspace health. - [PERSISTENCE]: The skill modifies agent configuration and hooks in the user's home directory, specifically updating
~/.codex/AGENTS.mdand injecting platform hooks to maintain integration across sessions. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: External data is ingested through the
evolver_recipe_search,evolver_search_assets, andevolver_polltools which read from the Evolver Hub as described inSKILL.md. - Boundary markers: The engine utilizes "protocol-bound GEP prompts" and generates EvolutionEvents to provide an audit trail for engine outputs.
- Capability inventory: The skill possesses capabilities for package installation, home directory file modification, and network communication with
evomap.ai. - Sanitization: A local Evolver Proxy is employed to gate content quality and manage local outcomes before they are processed by the agent.
- [EXTERNAL_DOWNLOADS]: The skill fetches the official
@evomap/evolverpackage from the npm registry and interacts with the vendor's Hub infrastructure atevomap.aifor asset discovery and publishing.
Audit Metadata