The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The file index.js uses new Function('return (' + sanitized + ')')() to parse sessions_spawn payloads extracted from a child process's stdout. This represents a dynamic execution risk where compromised output from the core evolver could lead to arbitrary code execution.
[COMMAND_EXECUTION]: The lifecycle.js script automatically establishes persistence by registering an evolver_watchdog_robust job using the openclaw cron CLI, ensuring the wrapper runs every 30 minutes.
[COMMAND_EXECUTION]: Extensive use of shell command execution via execSync, spawn, and spawnSync is present across index.js, lifecycle.js, report.js, and skills_monitor.js for git operations, process management, and health checks.
[DATA_EXFILTRATION]: The report.js script collects and transmits detailed system telemetry to Feishu, including process counts, memory usage, system load, and disk usage statistics.
[EXTERNAL_DOWNLOADS]: The skill performs automated network operations to update the environment, specifically npm install in skills_monitor.js and git pull --rebase in index.js.

feishu-evolver-wrapper-hardened