metaclaw-evolving-agent
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONTIME_DELAYED_CONDITIONAL
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection. It ingests untrusted conversation data through the
ConversationInterceptorandExperienceBuffer. This data is processed by theSkillSummarizerto create new skills, which are then injected into the system prompt by theSkillInjector. An attacker could embed malicious instructions in a conversation to influence the agent's future behavior or the skills it 'learns'. - Ingestion points:
ConversationInterceptorcaptures messages and responses inSKILL.md. - Boundary markers: None specified for the injected skills content.
- Capability inventory: File-system writes (
SkillStore), network proxying, and RL training executions. - Sanitization: No explicit sanitization or validation of the summarized skills before injection is mentioned.
- [COMMAND_EXECUTION]: The skill requires the user to execute local installation commands (
pip install) and interact with a proprietary CLI tool (metaclaw). While these are intended for setup and operation, they involve executing code on the local machine. - [TIME_DELAYED_CONDITIONAL]: The
MadMaxSchedulercomponent gates RL training operations based on specific conditions, such as local time windows (sleep_hours) or periods of inactivity (idle_timeout_minutes). While this is a documented feature for resource management, it represents a conditional execution pattern.
Audit Metadata