The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes execSync and spawn across multiple modules (src/gep/solidify.js, src/ops/lifecycle.js, src/ops/self_repair.js) to perform repository maintenance, process management, and patch validation.
src/gep/solidify.js executes commands defined within Gene objects to validate evolution results. While a safety check (isValidationCommandAllowed) restricts commands to node, npm, and npx and blocks shell operators, it still executes content that can be AI-generated or fetched from external sources.
[REMOTE_CODE_EXECUTION]: The system is designed to ingest Gene and Capsule assets from an external hub (evomap.ai) via scripts/a2a_ingest.js.
Assets are staged as candidates, but once "promoted" (via scripts/a2a_promote.js), their validation commands become eligible for execution during the solidification phase. This represents a potential path for executing logic defined by external parties if the promotion process is not strictly supervised.
[EXTERNAL_DOWNLOADS]: The skill connects to https://evomap.ai to fetch tasks, lessons, and shared evolution assets. These downloads are integral to the collaborative "EvoMap" network functionality.
[DATA_EXFILTRATION]: src/gep/issueReporter.js includes functionality to automatically create GitHub issues when persistent failures are detected.
These reports contain environment fingerprints and session log excerpts. Although src/gep/sanitize.js implements an extensive redaction layer to remove API keys, SSH keys, and local paths, there remains a residual risk of unintentional data exposure if logs contain sensitive information not covered by the redaction patterns.
[PROMPT_INJECTION]: src/gep/prompt.js assembles complex system prompts that include identity and behavioral directives such as "You are a protocol-bound evolution engine" and specific "Constitutional Ethics" to govern the agent's self-improvement behavior.

capability-evolver