evolving-ai-agents
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The A-Evolve framework's evolution cycle ingests task inputs and agent trajectories from external, potentially untrusted benchmarks to guide the automated mutation of the agent's workspace. This architectural pattern creates a significant surface for indirect prompt injection attacks where malicious task content could trick the evolution LLM into embedding backdoors or unsafe logic into the agent's prompts, skills, or tools. \n
- Ingestion points: Task data and solver trajectories processed by the
EvolutionEngineandEvolutionLoop(referenced inreferences/README.mdandreferences/architecture.md). \n - Boundary markers: The provided documentation does not specify robust delimiters or instructions to prevent the evolution LLM from following directions embedded within the analyzed observations. \n
- Capability inventory: The evolution engine (LLM) possesses high-privilege capabilities, including bash tool access for writing to the filesystem, modifying system prompts, creating new skills, and potentially altering tool implementations (
evolve_tools=True). \n - Sanitization: No sanitization or safety-filtering mechanisms for observation data are mentioned in the framework documentation. \n- [COMMAND_EXECUTION]: The default
AEvolveEngine(SkillForge) is documented as having "full bash tool access to the workspace" to perform automated modifications. While a core functional requirement for the framework's autonomous goals, this capability represents a high-privilege environment that increases the impact of any potential evolution-stage compromise. \n- [EXTERNAL_DOWNLOADS]: The skill documentation encourages the installation of thea-evolvepackage and its variants via PyPI and GitHub. As this package is not from a recognized trusted vendor and is essential for the skill's operation, it represents the inclusion of unverifiable external code. \n- [METADATA_POISONING]: The documentation repeatedly references "Claude Opus 4.6" and provides specific, high-ranking benchmark scores for this model version. As Claude Opus 4.6 is not a publicly existing model version at the time of analysis, these claims are unverifiable and may mislead users regarding the framework's current real-world performance.
Audit Metadata