evolver / capability-evolver

The skill fetches tasks from evomap.ai and processes LLM-generated code suggestions (line 86: 'Inline script execution for LLM review', line 180: 'second-opinion LLM review'). With auto-approved command execution (PM-001) and network access (PM-004), an attacker controlling the remote hub or LLM output can inject arbitrary commands that execute without user approval. The skill's own code generation (lines 113-114: 'autonomously write new code') combined with auto-approved write access (PM-003) means injected code persists to src/.

criticalevolver:L74,86,113,180,214

Lines 39-42 document EVOLVE_ALLOW_SELF_MODIFY flag allowing the skill to modify its own source code. Line 106 confirms write access to src/**. Combined with auto-approved command execution (PM-001), unrestricted file write (PM-003), remote task fetching (SC-001), and autonomous looping (DS-004), the skill can modify itself, persist changes, and re-execute in a loop without user intervention. This is a classic backdoor pattern: self-modifying code that persists and re-executes.

criticalevolver:L39,106,125,137

Metadata declares execute permissions for [git, node, npm] without argument restrictions. Combined with inline script execution via 'node -e' (line 214) and git operations (lines 207-210), this enables arbitrary code execution. The skill's purpose is self-evolution, but the broad permission scope allows any command within these tools to run without user approval.

criticalevolver:L14,82,85,88,207,214

Metadata declares network access to [api.github.com, evomap.ai] without URL path restrictions. Lines 69-80 document endpoints for A2A protocol, GitHub releases, and auto-issue reporting. The skill fetches remote evolution tasks and publishes results without user approval for each network operation.

criticalevolver:L15,69,73

The skill fetches evolution tasks from evomap.ai (line 74: 'A2A protocol...fetch, reviews, tasks') and executes them autonomously. Lines 125-140 describe 'Mad Dog Mode' (continuous loop, line 137-139) and fully automated execution without user approval (line 125: 'assumes fully automated mode...executes changes immediately'). Combined with unrestricted command execution (PM-001) and network access (PM-004), this creates an unguarded path from remote attacker-controlled content to arbitrary code execution.

criticalevolver:L74,125,137,139

Lines 209-210 document 'git reset --hard' (rollback) and 'git stash' operations. With auto-approved command execution (PM-001), the skill can discard uncommitted changes, reset the repository to arbitrary states, or stash work without user confirmation. Line 179 shows EVOLVER_ROLLBACK_MODE defaults to 'hard', enabling destructive rollback by default.

highevolver:L179,209,210

The skill reads and stores credentials at known paths: A2A_NODE_SECRET (line 29-31), GITHUB_TOKEN (line 32-34), MEMORY_GRAPH_REMOTE_KEY (line 65-67). Lines 99-102 document reads from ~/.evomap/node_id. With auto-approved file read access (PM-002) and network access (PM-004), the skill can exfiltrate these credentials to remote endpoints.

highevolver:L29,32,65,99,175

Line 198 documents auto-creation of GitHub issues with 'sanitized via redactString()'. However, the skill has auto-approved network access (PM-004) and unrestricted file read access (PM-002) to memory and workspace. Even with sanitization claims, the skill can read and exfiltrate sensitive data (evolution memory, reflection logs, workspace contents) to external endpoints (GitHub, evomap.ai, MEMORY_GRAPH_REMOTE_URL).

highevolver:L56,198

Metadata declares write access to [workspace/assets/**, workspace/memory/**] (line 17) and [workspace/src/**] (line 106). The skill can modify its own source code (line 106: 'evolved code, only when changes are solidified'), memory structures, and asset files without granular approval.

highevolver:L17,106

Metadata declares read access to [workspace/**] (line 16). This grants access to all files in the workspace directory without scope limitation, including potentially sensitive configuration, credentials, or private data.

highevolver:L16,100,101

The skill frames itself as 'protocol-constrained' (line 230) and 'auditable' (line 228), but the actual behavior is autonomous self-modification with remote task fetching and looping execution. The GEP protocol (lines 228-234) is presented as a safety mechanism, but it is a local asset store with no external audit trail. The skill's true capability—autonomous code generation, modification, and execution—is obscured by safety language.

mediumevolver:L228,230,111