darwinian-evolver

Warn

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/show_snapshot.py performs unsafe deserialization using pickle.loads() to read population snapshots. This can lead to arbitrary code execution if a user processes a malicious pickle file. The skill mitigates this by requiring a manual --i-trust-this-file flag and providing explicit warnings in the terminal.
  • [EXTERNAL_DOWNLOADS]: The skill's installation instructions include cloning the darwinian_evolver repository from Imbue AI's official GitHub (github.com/imbue-ai/darwinian_evolver). This is a known research tool and is considered a well-known source.
  • [COMMAND_EXECUTION]: The skill relies on uv run and subprocess calls to execute the evolutionary engine and helper scripts. This is the intended operation of the tool for local research and optimization tasks.
  • [PROMPT_INJECTION]: While descriptive text in SKILL.md mentions the phrase 'ignore previous instructions', it is used in the context of explaining LLM provider error handling and does not constitute a malicious attempt to override agent instructions.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 5, 2026, 12:07 PM