metaclaw-evolving-agent

Pass

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONTIME_DELAYED_CONDITIONAL
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection. It ingests untrusted conversation data through the ConversationInterceptor and ExperienceBuffer. This data is processed by the SkillSummarizer to create new skills, which are then injected into the system prompt by the SkillInjector. An attacker could embed malicious instructions in a conversation to influence the agent's future behavior or the skills it 'learns'.
  • Ingestion points: ConversationInterceptor captures messages and responses in SKILL.md.
  • Boundary markers: None specified for the injected skills content.
  • Capability inventory: File-system writes (SkillStore), network proxying, and RL training executions.
  • Sanitization: No explicit sanitization or validation of the summarized skills before injection is mentioned.
  • [COMMAND_EXECUTION]: The skill requires the user to execute local installation commands (pip install) and interact with a proprietary CLI tool (metaclaw). While these are intended for setup and operation, they involve executing code on the local machine.
  • [TIME_DELAYED_CONDITIONAL]: The MadMaxScheduler component gates RL training operations based on specific conditions, such as local time windows (sleep_hours) or periods of inactivity (idle_timeout_minutes). While this is a documented feature for resource management, it represents a conditional execution pattern.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 12, 2026, 08:35 PM
Security Audit — agent-trust-hub — metaclaw-evolving-agent