darwinian-evolver
Warn
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/show_snapshot.pyperforms unsafe deserialization usingpickle.loads()to read population snapshots. This can lead to arbitrary code execution if a user processes a malicious pickle file. The skill mitigates this by requiring a manual--i-trust-this-fileflag and providing explicit warnings in the terminal. - [EXTERNAL_DOWNLOADS]: The skill's installation instructions include cloning the
darwinian_evolverrepository from Imbue AI's official GitHub (github.com/imbue-ai/darwinian_evolver). This is a known research tool and is considered a well-known source. - [COMMAND_EXECUTION]: The skill relies on
uv runandsubprocesscalls to execute the evolutionary engine and helper scripts. This is the intended operation of the tool for local research and optimization tasks. - [PROMPT_INJECTION]: While descriptive text in
SKILL.mdmentions the phrase 'ignore previous instructions', it is used in the context of explaining LLM provider error handling and does not constitute a malicious attempt to override agent instructions.
Audit Metadata