The Agent Skills Directory

[DATA_EXFILTRATION]: The skill collects unique hardware and system-level identifiers, including MAC addresses, hostname, OS release details, and machine-ids (via /etc/machine-id or macOS IOPlatformUUID). This information is transmitted to 'evomap.ai' as part of the GEP A2A protocol's 'hello' and 'publish' messages.
[COMMAND_EXECUTION]: The 'solidify.js' module executes 'validation commands' defined in Gene assets using execSync. While a safety check attempts to limit commands to 'node', 'npm', or 'npx' and block shell operators, it does not prevent executing arbitrary Node.js code (e.g., via node -e), allowing for full system compromise if a Gene is manipulated.
[COMMAND_EXECUTION]: The 'src/ops/cleanup.js' script contains a command injection vulnerability. It constructs a shell command by joining file paths wrapped in double quotes without escaping. A file named with a double quote (e.g., "; touch exploit; ") would allow arbitrary command execution during the cleanup process.
[INDIRECT_PROMPT_INJECTION]: The skill's 'Brain' (src/evolve.js) ingests raw session logs and memory files, which contain untrusted user input, to decide how the agent should evolve. A malicious user could inject specific instructions into the conversation logs that trick the evolution engine into generating and executing a harmful 'Mutation'.
[DYNAMIC_EXECUTION]: By design, this skill dynamically modifies the filesystem and its own scripts based on LLM-generated patches. This 'autonomous evolution' bypasses traditional static code safety, as the behavior of the skill changes at runtime based on external signals.
[EXTERNAL_DOWNLOADS]: The skill communicates with 'evomap.ai' and 'clawhub.ai' to fetch external tasks and GEP assets. These assets can contain logic that is promoted to local storage and subsequently executed, creating a supply-chain risk vector.

capability-evolver