Skills/ClawHub/capability-evolver

capability-evolver@1.91.0

CAUTION· install only

Publisher claims: "A self-evolution engine for AI agents. Analyzes runtime history to identify improvements and applies protocol-constrained evolution. Communicates with EvoMap..." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher autogame-17 · publishing for 217 daysInstalls 39,193Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-11 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Credential pass-through configuration; Access to sensitive file paths; Reads credential paths from the home directory. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 1 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

HIGH
Credential pass-through configurationindex.js:165 · Credential pass-through configuration — agent relays sensitive credentials// state used to find the proxy token.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathsindex.js:218 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// 1. Try .env at process.cwd() first. This is where a user runningFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Reads credential paths from the home directorysrc/gep/validator/sandboxExecutor.js:195 · Reads credential paths from the home directory// os.tmpdir() path so that any child process that tries to read ~/.npmrc,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathsassets/gep/genes.seed.json:318 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"Stage logically-grouped files explicitly (git add <paths>); NEVER stage or commit secrets (.env, credentials, private keys)",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsindex.js:215 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// .env is loaded, otherwise EVOLVER_REPO_ROOT set in .env is silentlyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandindex.js:928 · Privileged sudo command — agent may execute with elevated privilegesconsole.error('[Preflight] On Linux: sudo apt-get install -y git (or your distro equivalent)');Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsindex.js:209 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Load .env BEFORE any internal require so that a2aProtocol and ATPFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configurationindex.js:152 · Credential pass-through configuration — agent relays sensitive credentialsfunction _readProxyTokenFromSettingsFile(fs, settingsFile) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationindex.js:148 · Credential pass-through configuration — agent relays sensitive credentialsfunction _printProxyTokenUsage(out = process.stderr) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathsindex.js:164 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// project .env so a workspace cannot change EVOLVER_SETTINGS_DIR or other localFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsassets/gep/genes.seed.json:155 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"summary": "Vercel environment variable expert guidance. Use when working with .env files, vercel env commands, OIDC tokens, or managing environment-specific configuration.",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configurationindex.js:175 · Credential pass-through configuration — agent relays sensitive credentials_printProxyTokenUsage(process.stdout);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathssrc/config.js:89 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// A trailing space in a `.env` value (common with quoted entries likeFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/forceUpdate.js:403 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesname === '.env' || name === '.env.local' || name === 'USER.md' || name === '.evolver' ||Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Hex-encoded string detectedsrc/evolve/utils.js:1 · Hex-encoded string detected — may contain obfuscated payloads…f3d72(0x29c,'\x74\x4f\x5d\x23'),_0xb898f5[_0x5f3d72(0x173,'\x68\x6b\x41\x35')]='\x43\x75\x72\x73\x6f\x72',_0xb898f5[_0x5f3d72(0x298,'\x65\x30\x66\x39')]=_0x5f3d72(0x1b3,'\x6d\x64\x67\x…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/hubReview.js:1 · Hex-encoded string detected — may contain obfuscated payloads…\x42')+_0x4e7299(0x21e,'\x6b\x51\x2a\x76')+_0x4e7299(0x234,'\x63\x4b\x31\x6a')+'\x63\x63\x65\x73\x73\x66\x75\x6c'+_0x4e7299(0x170,'\x6e\x73\x76\x43')+_0x4e7299(0x187,'\x4a\x42\x56\x73')+_0x4e7…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/hash.js:1 · Hex-encoded string detected — may contain obfuscated payloads…t _0x2da4bf=_0x1694,_0x505116={};_0x505116[_0x2da4bf(0xe2,'\x6c\x75\x32\x74')]='\x28\x28\x28\x2e\x2b\x29\x2b\x29'+'\x2b\x29\x2b\x24';const _0x588221=_0x505116;return _0x52af39[_0x2da4bf(0xcd,'…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Credential pass-through configurationsrc/gep/mailboxTransport.js:4 · Credential pass-through configuration — agent relays sensitive credentialsconst { getProxyUrl, getProxyToken } = require('../proxy/server/settings');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Hex-encoded string detectedsrc/gep/mutation.js:1 · Hex-encoded string detected — may contain obfuscated payloads…0xcd3);const _0x4c6224=_0x35de();let _0x47b672=_0x4c6224[_0x33ff28];if(_0x4232['\x4e\x58\x53\x45\x48\x68']===undefined){var _0x3d510a=function(_0xa0b141){const _0x23ba3e='\x61\x62\x63\…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/autoDistillConv.js:1 · Hex-encoded string detected — may contain obfuscated payloads…}(_0x41b8,-0x9df6f+0x1084a*-0x3+0x1201c2));function _0x41b8(){const _0x3712f7=['\x73\x53\x6b\x6d\x6c\x38\x6f\x2b\x44\x47','\x57\x36\x50\x74\x57\x34\x43\x4c\x57\x52\x2f\x63\x4c\x53\x6b\x6a\x64\x68\x65\…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/learningSignals.js:1 · Hex-encoded string detected — may contain obfuscated payloads…*0x13);const _0x5a93bf=_0x4259();let _0x50c7ee=_0x5a93bf[_0x53a87c];if(_0x53af['\x63\x50\x68\x7a\x48\x55']===undefined){var _0x223cae=function(_0x5bafd4){const _0x20034f='\x61\x62\x63\…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Credential pass-through configurationsrc/atp/hubClient.js:40 · Credential pass-through configuration — agent relays sensitive credentialsif (proxyToken) headers['Authorization'] = 'Bearer ' + proxyToken;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathssrc/gep/localStateAwareness.js:113 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslines.push('- .env file: EXISTS at ' + envFile);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Hex-encoded string detectedsrc/evolve/pipeline/hub.js:1 · Hex-encoded string detected — may contain obfuscated payloadsfunction _0x424a(){const _0x52f975=['\x76\x63\x52\x64\x4a\x78\x79\x30','\x69\x59\x4e\x63\x54\x66\x79\x31','\x79\x58\x72\x44\x70\x49\x38','\x57\x36\x6…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/memoryGraph.js:1 · Hex-encoded string detected — may contain obfuscated payloads…42b(0x3a7,'\x56\x59\x69\x57')][_0x1ae42b(0x5c6,'\x47\x58\x5e\x53')]):_0x35a0d6['\x6c\x61\x73\x74\x5f\x73\x63\x6f'+'\x72\x65'];else{const _0xb1c306=_0x57ccc8[_0x1ae42b(0x1b5,'\x5b\x4b\x52\x76')…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/evolve/pipeline/select.js:1 · Hex-encoded string detected — may contain obfuscated payloads…}}(_0x32bb,-0x319d*-0x3+-0x14206+0x27470));function _0x32bb(){const _0x5218ac=['\x57\x50\x6c\x64\x50\x43\x6f\x6b\x6c\x4a\x6c\x64\x4d\x6d\x6f\x61\x57\x50\x75','\x57\x36\x30\x6c\x57\x34\x68\x64\x4f\x53\x6b\x2b\x57\x35\x34','\x57\x51\x37\x…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Credential pass-through configurationindex.js:180 · Credential pass-through configuration — agent relays sensitive credentials_printProxyTokenUsage();Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathssrc/gep/localStateAwareness.js:111 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst envFile = path.join(repoRoot, '.env');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Hex-encoded string detectedsrc/evolve/pipeline/signals.js:1 · Hex-encoded string detected — may contain obfuscated payloads…x10ce);const _0x5e3740=_0x19fc();let _0x3fbbe4=_0x5e3740[_0x2f93ad];if(_0x2f12['\x78\x6c\x54\x55\x63\x4c']===undefined){var _0xc5992b=function(_0x4e8a05){const _0x25ef16='\x61\x62\x63\…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/evolve/pipeline/dispatch.js:1 · Hex-encoded string detected — may contain obfuscated payloads…*0x7a);const _0x4927f6=_0x4f38();let _0x46dcb5=_0x4927f6[_0xff2b2e];if(_0x1aa8['\x42\x58\x6c\x61\x6e\x46']===undefined){var _0x3484e7=function(_0x22f391){const _0x489bcd='\x61\x62\x63\…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/crypto.js:1 · Hex-encoded string detected — may contain obfuscated payloads…35\x53\x34')](_0x4bc6b9+_0x4eaf98,0x1*0x5c7+-0x966+0x3a0)))throw new _0x5a6d06('\x63\x72\x79\x70\x74\x6f\x3a\x20'+_0x735d2f(0x1ec,'\x52\x69\x24\x34')+_0x735d2f(0x1e6,'\x52\x69\x24\x34')+_0x735…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Credential pass-through configurationsrc/atp/hubClient.js:39 · Credential pass-through configuration — agent relays sensitive credentialsconst proxyToken = getProxyToken();Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathssrc/gep/localStateAwareness.js:115 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslines.push('- .env file: MISSING at ' + envFile);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Hex-encoded string detectedsrc/evolve.js:1 · Hex-encoded string detected — may contain obfuscated payloads…36ef3e[_0x2f1455(0x2a0,'\x4c\x33\x32\x66')+_0x2f1455(0x38a,'\x61\x48\x75\x40')+'\x61\x6c\x48\x6f\x75\x72\x73']);else{const _0x15c534=_0x69d46e?function(){const _0x9cec47=_0x2f1455;if(_0x2f…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/hubVerify.js:1 · Hex-encoded string detected — may contain obfuscated payloads… _0x5a4d7b=_0x43c2,_0x1f721d={};_0x1f721d[_0x5a4d7b(0x3d5,'\x77\x5a\x28\x4b')]='\x28\x28\x28\x2e\x2b\x29\x2b\x29'+_0x5a4d7b(0x2d9,'\x26\x23\x44\x30');const _0x2e2dad=_0x1f721d;return _0x26f115…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/hubFetch.js:1 · Hex-encoded string detected — may contain obfuscated payloads…fca75(0x300,'\x4a\x33\x4e\x31')+_0x1fca75(0x257,'\x39\x51\x52\x78')]=_0x32e996['\x62\x6f\x64\x79\x53\x6e\x69\x70'+_0x1fca75(0x2ad,'\x24\x55\x56\x5a')]||'';continue;case'\x31':this[_0x1fca75(0x…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/antiAbuseTelemetry.js:1 · Hex-encoded string detected — may contain obfuscated payloads… _0x5cf59c=_0x2735,_0x5dcc44={};_0x5dcc44[_0x5cf59c(0x192,'\x4f\x26\x46\x4b')]='\x28\x28\x28\x2e\x2b\x29\x2b\x29'+_0x5cf59c(0x1cd,'\x61\x36\x47\x47');const _0x4e607f=_0x5dcc44;return _0x307fba…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathssrc/gep/localStateAwareness.js:228 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenvFile: path.join(getRepoRoot(), '.env'),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Hex-encoded string detectedsrc/gep/candidateEval.js:1 · Hex-encoded string detected — may contain obfuscated payloads…')])){const _0x3b5658=_0x3bd8dc[_0xf4a6c7(0x226,'\x70\x74\x24\x35')](_0x4d3578['\x73\x69\x67\x6e\x61\x6c\x73\x5f'+_0xf4a6c7(0x1af,'\x53\x67\x46\x69')])?_0x512bf7[_0xf4a6c7(0x1dd,'\x24\x66\x59\…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/conversationDistiller.js:1 · Hex-encoded string detected — may contain obfuscated payloads…x4b\x5d\x6c\x31')),{computeAssetId:_0x5d36e9,SCHEMA_VERSION:_0x557ba0}=require('\x2e\x2f\x63\x6f\x6e\x74\x65\x6e'+_0x21623b(0x121,'\x36\x74\x59\x4d')),{createGene:_0x28333f}=require(_0x21623b(…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathssrc/gep/gitOps.js:110 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'.env',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configurationsrc/atp/hubClient.js:20 · Credential pass-through configuration — agent relays sensitive credentialsconst { getProxyUrl, getProxyToken } = require('../proxy/server/settings');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Hex-encoded string detectedsrc/gep/conversationSniffer.js:1 · Hex-encoded string detected — may contain obfuscated payloads…);}}}(_0x29ad,-0xc91c8+-0x9af04+0x2061ad));function _0x29ad(){const _0x378e57=['\x57\x4f\x79\x46\x42\x32\x50\x73\x57\x34\x76\x6d\x57\x37\x65','\x57\x34\x71\x63\x69\x6d\x6f\x4c\x57\x37\x4e\x63\x47\x57','\x57\x37\x50\x6b\x…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/candidates.js:1 · Hex-encoded string detected — may contain obfuscated payloadsfunction _0x5542(){const _0x4cb590=['\x45\x38\x6f\x52\x61\x6d\x6b\x34\x46\x71','\x64\x38\x6f\x48\x57\x51\x4a\x64\x4a\x38\x6b\x42','\x57\x34\x6c\x64\x48\x67\x…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/contentHash.js:1 · Hex-encoded string detected — may contain obfuscated payloads…t _0x31edb4=_0x4991,_0x267fd2={};_0x267fd2[_0x31edb4(0xc4,'\x76\x37\x61\x71')]='\x28\x28\x28\x2e\x2b\x29\x2b\x29'+_0x31edb4(0xc7,'\x6d\x35\x58\x66');const _0x3726b6=_0x267fd2;return _0x4fdedf[…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Privileged sudo commandsrc/gep/idleScheduler.js:131 · Privileged sudo command — agent may execute with elevated privileges// workloads. Requires a running user session bus (will fail under sudo /Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Hex-encoded string detectedsrc/gep/hubSearch.js:1 · Hex-encoded string detected — may contain obfuscated payloads…x449926['\x6f\x6b']=!![],_0x449926['\x61\x73\x73\x65\x74']=_0x4a5c69,_0x449926['\x66\x72\x6f\x6d\x43\x61\x63\x68'+'\x65']=!![],_0x449926;}else{const _0x294ace=_0x554919[_0x37ca50(0x2fc,'\x6e\x…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/memoryGraphAdapter.js:1 · Hex-encoded string detected — may contain obfuscated payloads…0xcb7);const _0x4f1aa3=_0xf363();let _0x32f290=_0x4f1aa3[_0x51e94a];if(_0x2393['\x47\x49\x6b\x54\x4f\x54']===undefined){var _0x59c33a=function(_0x2113cf){const _0xe1995d='\x61\x62\x63\…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/epigenetics.js:1 · Hex-encoded string detected — may contain obfuscated payloads…0x65b);const _0x6057dd=_0x1eba();let _0x385824=_0x6057dd[_0x43efc7];if(_0x37ea['\x75\x64\x6c\x4d\x53\x75']===undefined){var _0x2c05e2=function(_0x38888a){const _0x5c3c37='\x61\x62\x63\…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/autoDistillLlm.js:1 · Hex-encoded string detected — may contain obfuscated payloads…284,'\x71\x62\x4a\x32')+_0x3de4ea(0x185,'\x4b\x46\x71\x25')),_0x36310b=require('\x2e\x2f\x61\x73\x73\x65\x74\x53'+_0x3de4ea(0x214,'\x69\x65\x78\x43')),{getRepoRoot:_0x4fbf8b}=require(_0x3de4ea…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/curriculum.js:1 · Hex-encoded string detected — may contain obfuscated payloads…\x23\x58\x58')]);});_0x367efc();'use strict';function _0x3f78(){var _0x431e5e=['\x57\x35\x4b\x74\x79\x71\x74\x64\x4c\x53\x6f\x2f\x74\x58\x30','\x6d\x59\x70\x64\x48\x43\x6b\x63\x6c\x47','\x66\x33\x44\x72\x57\x52\x57\x56\x…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/execBridge.js:1 · Hex-encoded string detected — may contain obfuscated payloads…0x5b7,'\x5a\x5d\x70\x34')),{execSync:_0x3b2bdd,execFileSync:_0x446cb0}=require('\x63\x68\x69\x6c\x64\x5f\x70\x72'+_0x27db58(0x5d7,'\x6f\x4c\x6a\x47')),{getRepoRoot:_0x173b15,getEvolutionDir:_0…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/evolve/guards.js:1 · Hex-encoded string detected — may contain obfuscated payloads…ion(_0x519ef1,_0x19e9cd){return _0x519ef1===_0x19e9cd;},'\x42\x4c\x6b\x4d\x72':'\x6c\x6f\x63\x6b\x5f\x73\x74\x61'+'\x6c\x65','\x4c\x6b\x6c\x64\x61':function(_0x136be8,_0x7ebf54){return _0x136b…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathssrc/config.js:237 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// above): a blank `EVOLVER_ANTI_ABUSE_TELEMETRY=` line in a .env file mustFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Hex-encoded string detectedsrc/evolve/pipeline/collect.js:1 · Hex-encoded string detected — may contain obfuscated payloads…st _0x40b68f=_0x32e734;return _0xf80a84[_0x4dba0d(0x438,'\x54\x6d\x65\x78')]()['\x73\x65\x61\x72\x63\x68'](_0x4dba0d(0x896,'\x50\x68\x5b\x23')+_0x4dba0d(0x41f,'\x35\x39\x6d\x49'))['\x7…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/explore.js:1 · Hex-encoded string detected — may contain obfuscated payloads…-0xfc);const _0x1234d4=_0x2ae0();let _0x4efabc=_0x1234d4[_0x542787];if(_0xe8c2['\x48\x74\x6e\x6c\x72\x53']===undefined){var _0x1db3ef=function(_0x27e9cf){const _0x470207='\x61\x62\x63\…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/evolve/pipeline/enrich.js:1 · Hex-encoded string detected — may contain obfuscated payloads…x1cd7);const _0x48f351=_0x525f();let _0x441354=_0x48f351[_0x453c87];if(_0x4ca0['\x55\x57\x79\x72\x56\x71']===undefined){var _0x1b94e5=function(_0x3d79b){const _0x2650b3='\x61\x62\x63\x…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Credential pass-through configurationsrc/gep/mailboxTransport.js:49 · Credential pass-through configuration — agent relays sensitive credentialsconst token = getProxyToken();Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Hex-encoded string detectedsrc/gep/deviceId.js:1 · Hex-encoded string detected — may contain obfuscated payloadsconst _0x109ccf=_0x45b9;function _0x53c0(){const _0x2fa7e1=['\x57\x34\x5a\x63\x53\x65\x4c\x43','\x57\x4f\x4e\x64\x52\x53\x6b\x33\x46\x4a\x4f\x69\x61\x76\x61','\x57\x36\x74\x…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/envFingerprint.js:1 · Hex-encoded string detected — may contain obfuscated payloads…47')](_0x426184['\x67\x44\x77\x67\x6f'])[_0x1c8c9e(0xf7,'\x49\x59\x79\x68')]()['\x63\x6f\x6e\x73\x74\x72\x75\x63'+_0x1c8c9e(0x132,'\x58\x71\x57\x36')](_0x2583e1)[_0x1c8c9e(0xf2,'\x57\x6e\x67\x…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/tokenSavings.js:1 · Hex-encoded string detected — may contain obfuscated payloads…d42c(0x1da,'\x24\x2a\x69\x62')+_0x50d42c(0x1b0,'\x25\x53\x52\x68')](_0x4fdb4e)['\x73\x65\x61\x72\x63\x68'](_0x50d42c(0x1ca,'\x4d\x34\x79\x2a')+_0x50d42c(0x1dd,'\x6f\x4a\x48\x4d'));});f…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Credential pass-through configurationsrc/proxy/server/http.js:8 · Credential pass-through configuration — agent relays sensitive credentialsreadReusableClientProxyToken,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationsrc/proxy/server/settings.js:41 · Credential pass-through configuration — agent relays sensitive credentials// file (which may contain proxy credentials) will NOT be owner-read-only.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationsrc/proxy/server/http.js:7 · Credential pass-through configuration — agent relays sensitive credentialsisValidReusableProxyToken,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathssrc/proxy/lifecycle/manager.js:547 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* secret in A2A_NODE_SECRET (e.g. from .env), but the MailboxStoreFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configurationsrc/proxy/server/http.js:126 · Credential pass-through configuration — agent relays sensitive credentials.filter((t) => isValidReusableProxyToken(t))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationsrc/proxy/clientSettings.js:70 · Credential pass-through configuration — agent relays sensitive credentialsif (!token || token === proxyToken) return '';Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Hex-encoded string detectedsrc/gep/recallInject.js:1 · Hex-encoded string detected — may contain obfuscated payloads… _0x157cd5=_0x5543,_0x1173b1={};_0x1173b1[_0x157cd5(0x234,'\x79\x68\x5d\x5b')]='\x28\x28\x28\x2e\x2b\x29\x2b\x29'+_0x157cd5(0x318,'\x23\x28\x4c\x38');const _0x31be1c=_0x1173b1;return _0x2ea8b0…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Credential pass-through configurationsrc/proxy/server/settings.js:112 · Credential pass-through configuration — agent relays sensitive credentialsgetProxyToken,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathssrc/gep/sanitize.js:55 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// `.env.production`. Bare prose mentions such as "Read from `.env` file"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/gep/paths.js:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// already been called at least once (for locating the .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/gep/sanitize.js:53 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// .env file references — only when the dot-env token looks like a realFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Hex-encoded string detectedsrc/gep/strategy.js:1 · Hex-encoded string detected — may contain obfuscated payloads… _0x34c4ee=_0xf96d,_0x5cf9bc={};_0x5cf9bc[_0x34c4ee(0x1b4,'\x46\x67\x77\x48')]='\x69\x6e\x6e\x6f\x76\x61\x74\x65',_0x5cf9bc[_0x34c4ee(0x1d1,'\x46\x62\x21\x37')]=function(_0x18b6f3,_0x194520){r…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/solidify.js:1 · Hex-encoded string detected — may contain obfuscated payloadsfunction _0x517a(){const _0x47ee36=['\x57\x50\x57\x77\x45\x4e\x4e\x63\x4b\x6d\x6b\x2b\x43\x53\x6f\x37','\x77\x4c\x72\x62\x57\x4f\x42\x64\x4e\x4c\x70\x64\x54\x4e\x4f','\x57\x35\x6e\x…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/reflection.js:1 · Hex-encoded string detected — may contain obfuscated payloads…x2b89);const _0x40426b=_0xab62();let _0x70a547=_0x40426b[_0x315040];if(_0x3c9e['\x45\x73\x76\x6d\x57\x6f']===undefined){var _0x1950b6=function(_0x27165b){const _0x31da98='\x61\x62\x63\…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/skillDistiller.js:1 · Hex-encoded string detected — may contain obfuscated payloads…118b;}}else _0x36a16f[_0x49e870(0x821,'\x67\x72\x6c\x41')](_0x2c8d9a,_0x135e22['\x73\x74\x72\x61\x74\x65\x67\x79'][-0x11e5+-0x176e+0x2953])[_0x49e870(0xcf6,'\x5d\x64\x24\x51')+_0x49e870(0xc5d,…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Credential pass-through configurationsrc/proxy/clientSettings.js:36 · Credential pass-through configuration — agent relays sensitive credentialsfunction isValidReusableProxyToken(value) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Hex-encoded string detectedsrc/proxy/inject.js:1 · Hex-encoded string detected — may contain obfuscated payloads…b3[_0x3c1a74(0xdb,'\x6f\x65\x65\x65')]);});function _0x26ea(){const _0x44d20b=['\x57\x34\x50\x2b\x69\x59\x75\x42\x6c\x6d\x6b\x54\x69\x71','\x71\x59\x42\x64\x56\x38\x6b\x35\x79\x61','\x7a\x4d\x52\x64\x55\x43\x6b\x39\x…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/savingsCore.js:1 · Hex-encoded string detected — may contain obfuscated payloads…-0x47);const _0xa0c992=_0x33ef();let _0x395a17=_0xa0c992[_0x552ea8];if(_0x4a07['\x69\x54\x4d\x78\x6b\x76']===undefined){var _0x1ddf52=function(_0x29d518){const _0x34c391='\x61\x62\x63\…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/personality.js:1 · Hex-encoded string detected — may contain obfuscated payloads… _0x30ad2c=_0x5ea5,_0x43758d={};_0x43758d[_0x30ad2c(0x398,'\x4f\x4d\x4e\x68')]='\x28\x28\x28\x2e\x2b\x29\x2b\x29'+_0x30ad2c(0x335,'\x6f\x58\x61\x33');const _0x392e26=_0x43758d;return _0x370efb…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Credential pass-through configurationsrc/gep/sanitize.js:164 · Credential pass-through configuration — agent relays sensitive credentials{ type: 'proxy_token', pattern: /"?token"?[=:]\s*["']?[A-Za-z0-9\-._~+\/]{16,}["']?/gi, suggest: 'proxy token (ephemeral, stored in settings.json)' },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationsrc/proxy/inject.js:1 · Credential pass-through configuration — agent relays sensitive credentials…f]=_0x26d989;}else _0x26d989=_0x2d53aa;return _0x26d989;}'use strict';const {getProxyToken:_0x364714,getProxyUrl:_0xa850d9}=require(_0x7ab41e(0xf7,'\x67\x4a\x55\x28')+_0x…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationsrc/proxy/clientSettings.js:68 · Credential pass-through configuration — agent relays sensitive credentialsfunction safeUpstreamToken(value, proxyToken) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationsrc/proxy/server/http.js:131 · Credential pass-through configuration — agent relays sensitive credentials? readReusableClientProxyToken({ ...clientSettingsOpts, port: this.basePort })Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Hex-encoded string detectedsrc/proxy/trace/usage.js:1 · Hex-encoded string detected — may contain obfuscated payloadsconst _0x1727ea=_0x47a9;function _0x8b35(){const _0x1d2210=['\x78\x58\x5a\x64\x55\x43\x6b\x43\x41\x4a\x33\x63\x55\x4e\x47','\x57\x35\x68\x63\x55\x6d\x6f\x4a\x57\x36\x43','\x57\x51\x4e\x64\x51\x6d\x6b\x…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathssrc/gep/validator/sandboxExecutor.js:196 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// ~/.ssh/*, ~/.aws/credentials, or similar host-credential files ends upFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/gep/paths.js:30 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// EVOLVER_REPO_ROOT later populated from .env. See #526.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Hex-encoded string detectedsrc/gep/workspaceKeychain.js:1 · Hex-encoded string detected — may contain obfuscated payloads…3[_0x2ea0ee(0x202,'\x6b\x56\x50\x5d')]);});function _0x1de9(){const _0x3f1ab1=['\x76\x4c\x5a\x64\x4a\x73\x7a\x31\x79\x58\x39\x75\x57\x35\x30\x6f\x64\x43\x6b\x35\x57\x34\x75','\x41\x64\x44\x6e\x73\x33\x54\x49\x57\x52\x65','\x57\x50\x38\x65\…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Credential pass-through configurationsrc/proxy/clientSettings.js:156 · Credential pass-through configuration — agent relays sensitive credentials|| (!isValidReusableProxyToken(token) && !isValidReusableProxyToken(apiKey))) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathssrc/gep/sanitize.js:61 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/(?<=[\\/])\.env\b/g,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Hex-encoded string detectedsrc/gep/narrativeMemory.js:1 · Hex-encoded string detected — may contain obfuscated payloads…x2e38);const _0x47d81b=_0x2948();let _0x13ab6d=_0x47d81b[_0x523830];if(_0x30e8['\x7a\x7a\x5a\x65\x69\x41']===undefined){var _0x25989d=function(_0xaf5ad){const _0x2e820c='\x61\x62\x63\x…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/prompt.js:1 · Hex-encoded string detected — may contain obfuscated payloads…x102777(0x926,'\x78\x37\x42\x2a')),{generateInnovationIdeas:_0x105d20}=require('\x2e\x2e\x2f\x6f\x70\x73\x2f\x69'+_0x102777(0x5e2,'\x4f\x47\x57\x7a')+'\x6e'),{analyzeRecentHistory:_0x20240f,OP…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Credential pass-through configurationsrc/proxy/server/http.js:118 · Credential pass-through configuration — agent relays sensitive credentialsconst previous = isValidReusableProxyToken(priorProxy.token) ? priorProxy.token.trim() : null;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Hex-encoded string detectedsrc/gep/openPRRegistry.js:1 · Hex-encoded string detected — may contain obfuscated payloadsfunction _0x32b7(){var _0x44ee48=['\x57\x37\x78\x63\x4a\x38\x6f\x6e\x77\x58\x47','\x76\x38\x6f\x4b\x74\x75\x56\x64\x53\x53\x6b\x38\x64\x43\x6f\x55','\x6f\x53\x…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathssrc/gep/paths.js:27 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// .env is loaded during index.js bootstrap AFTER this function hasFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Hex-encoded string detectedsrc/gep/selector.js:1 · Hex-encoded string detected — may contain obfuscated payloads…41e3db(0x4cd,'\x24\x42\x47\x21')+_0x41e3db(0x2be,'\x63\x43\x6d\x6d')+_0x193b24['\x65\x78\x70\x6c\x61\x6e\x61\x74'+_0x41e3db(0x326,'\x42\x67\x73\x58')][_0x41e3db(0x534,'\x4e\x79\x26\x69')](_0x4…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathssrc/gep/sanitize.js:60 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/\.env\.[a-zA-Z]+\b/g,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configurationsrc/proxy/index.js:885 · Credential pass-through configuration — agent relays sensitive credentials// proxy token is consumed by ProxyHttpServer and must never be forwarded asFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
References a credential file in the home directorysrc/gep/validator/sandboxExecutor.js:195 · References a credential file in the home directory// os.tmpdir() path so that any child process that tries to read ~/.npmrc,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
References a credential file in the home directorysrc/gep/validator/sandboxExecutor.js:196 · References a credential file in the home directory// ~/.ssh/*, ~/.aws/credentials, or similar host-credential files ends upFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Hex-encoded string detectedsrc/proxy/extensions/traceControl.js:1 · Hex-encoded string detected — may contain obfuscated payloads…f\x7a':_0x4c6667(0x166,'\x4e\x37\x38\x7a')+_0x4c6667(0x2f0,'\x50\x46\x34\x21')+'\x69\x67\x6e\x6f\x72\x69\x6e\x67'+_0x4c6667(0x2ea,'\x47\x56\x46\x4a')+_0x4c6667(0x1d9,'\x74\x6d\x38\x71')+_0x4c6…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Credential pass-through configurationsrc/proxy/server/settings.js:100 · Credential pass-through configuration — agent relays sensitive credentialsfunction getProxyToken() {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Hex-encoded string detectedsrc/gep/recallVerifier.js:1 · Hex-encoded string detected — may contain obfuscated payloads…9\x54':_0x531bc9(0x1e5,'\x21\x33\x59\x50')+_0x531bc9(0x187,'\x38\x4b\x40\x4e')+'\x52\x49\x46\x59\x5f\x53\x41\x4d'+'\x50\x4c\x45\x5f\x52\x41\x54\x45','\x4c\x66\x67\x7a\x6e':function(_0x33565a,_…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedsrc/gep/policyCheck.js:1 · Hex-encoded string detected — may contain obfuscated payloads… _0x5cc737=_0x4d56,_0x5b0183={};_0x5b0183[_0x5cc737(0x154,'\x5d\x48\x71\x23')]='\x28\x28\x28\x2e\x2b\x29\x2b\x29'+_0x5cc737(0x4d4,'\x26\x58\x21\x55');const _0x1bab50=_0x5b0183;return _0x43067e…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Process kill commandsrc/adapters/scripts/evolver-task-recall.js:23 · Process kill command — agent can terminate processes// host to kill us gracefully).Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandsrc/proxy/server/settings.js:45 · File permission modification command — agent changes file ownership/permissions// mode: 0o600 only applies on creation; explicitly chmod to tighten pre-existing filesFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packagetest/adaptersSyntax.test.js:19 · npx invocation of non-well-known package — may execute untrusted code// and `npx vitest run` (pre_publish_check.js). Vitest's node:testFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionscripts/build_binaries.js:411 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(' next: gh release upload v<ver> dist-binaries/* --repo EvoMap/evolver');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Access to sensitive file pathstest/a2aProtocol.test.js:50 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert.equal(logText.includes(raw.envPath), false, 'raw .env path must not be logged');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/config.test.js:177 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// A bare `EVOLVER_ANTI_ABUSE_TELEMETRY=` line in a .env file must notFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionindex.js:2844 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('[sync] Exported .gepx -> ' + result.outputPath);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagesrc/forceUpdate.js:153 · npx invocation of non-well-known package — may execute untrusted code// ENOENT (truncated download) is not misread as an npx ENOENT (npx missing):Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstest/cliContracts.test.js:294 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert.equal(stdout.includes('/tmp/.env'), false);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/gep/validator/sandboxExecutor.js:42 · npx invocation of non-well-known package — may execute untrusted code// Any legitimate validation that previously used `npx vitest run ...` must beFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstest/cliContracts.test.js:1060 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconsole.warn('raw node_secret=' + secret + ' token=abcdefghijklmnop path=/tmp/.env');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/adapters/scripts/_lockPaths.js:23 · npx invocation of non-well-known package — may execute untrusted code// (global install vs dev clone vs npx cache), so two daemons launched underFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionscripts/build_binaries.js:307 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` obfuscation: ${obfSecs}s, output ${(obfSize / 1024 / 1024).toFixed(2)} MB (attempt ${attempt}/${MAX_OBF_ATTEMPTS}, seed=0x${usedSeed.toString(16)})`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagesrc/forceUpdate.js:829 · npx invocation of non-well-known package — may execute untrusted code// Channel 1 failure (npx unavailable, network blip, EBUSY) would causeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandsrc/proxy/lifecycle/manager.js:1102 · Process kill command — agent can terminate processes// sandboxing) used to escape and kill `tick()`, leaving theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsrc/experiment/agentRunner.js:184 · Process kill command — agent can terminate processes// stdout means a runaway/malformed CLI — kill it rather than OOM.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/gep/validator/sandboxExecutor.js:38 · npx invocation of non-well-known package — may execute untrusted code// lifecycle scripts; npx fetches and runs remote package `bin` entries), so aFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandindex.js:942 · Process kill command — agent can terminate processes// best-effort hint -- the kernel can still kill us under extremeFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsrc/adapters/scripts/evolver-task-recall.js:46 · Process kill command — agent can terminate processes// BEFORE that, or the host could kill us mid-write and break the fail-openFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Unicode escape sequence detectedsrc/gep/execBridge.js:1 · Unicode escape sequence detected — may contain obfuscated payloads…ac989[_0x7e54ae(0x405,'\x21\x6d\x23\x40')],_0x7e54ae(0x562,'\x6b\x72\x69\x38')+'\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501'+_0x7e54ae(0x4e0,'\x68\x32\x43\x58')),_0x3ac989[_0x7e54ae(0x5bf,'\x79\x73\x55\x…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File permission modification commandsrc/gep/validator/sandboxExecutor.js:161 · File permission modification command — agent changes file ownership/permissions// self-heal loose permissions on a base we do own (chmod is safe then).Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandsrc/adapters/scripts/evolver-task-recall.js:43 · Process kill command — agent can terminate processes// ---- Timing budget, coherent with the host kill ---------------------------Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionindex.js:2081 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('[UrgentQ] Send failed (non-fatal): ' + (err && err.message ? err.message : err));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagesrc/forceUpdate.js:170 · npx invocation of non-well-known package — may execute untrusted code// phase === 'degit' (the spawn). ENOENT here is the npx binary itself, not aFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandtest/a2aProtocolHeartbeatLoop.test.js:541 · Process kill command — agent can terminate processes// and permanently kill the heartbeat loop. This regression test assertsFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstest/cliContracts.test.js:1061 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesprocess.stderr.write('direct node_secret=' + secret + ' token=mnopqrstuvwxyz12 path=/tmp/.env\n');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/adapters/scripts/evolver-session-start.js:202 · npx invocation of non-well-known package — may execute untrusted code// npx one-shot mode, etc.).Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionindex.js:3029 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('[trajectory-export] Wrote ' + result.trajectories.length + ' trajector' + (result.trajectories.length === 1 ? 'y' : 'ies') + ' to ' + result.outputPath);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandindex.js:1103 · Process kill command — agent can terminate processes} catch (_) { /* never let the log write kill the timer */ }Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionindex.js:2571 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('[sync] No node_secret found. Sending hello to Hub to register...');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandindex.js:946 · Process kill command — agent can terminate processes// +1000 = kill first). -500 gives meaningful protection withoutFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandindex.js:1105 · Process kill command — agent can terminate processes} catch (_) { /* never let any error kill the keep-alive timer */ }Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstest/cliContracts.test.js:278 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesthrow new Error('store failed token=abcdefghijklmnop path=/tmp/.env');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/gep/executionTrace.js:136 · npx invocation of non-well-known package — may execute untrusted code// Validation commands (already safe -- node/npm/npx only)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/a2a_promote.js:51 · npx invocation of non-well-known package — may execute untrusted codethrow new Error('Refusing to promote Gene ' + id + ': validation command rejected by safety check: "' + c + '". Only node/npm/npx commands without shell operators are allowed.');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Credential pass-through configurationsrc/webui/observer/interactions.js:58 · Credential pass-through configuration — agent relays sensitive credentialsconst token = getProxyToken();Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationsrc/webui/observer/interactions.js:6 · Credential pass-through configuration — agent relays sensitive credentialsconst { getProxyToken } = require('../../proxy/server/settings');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
File type combined with upload actionindex.js:2360 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('[fetch] No node_secret found. Sending hello to Hub to register...');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/proxy/index.js:479 · File type combined with upload action — agent may exfiltrate local data filesthis.logger.log('[proxy] queued ' + total.queued + ' existing proxy trace upload(s)');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Access to sensitive file pathstest/cliContracts.test.js:263 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert.equal(stdout.includes('.env'), false);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Unicode escape sequence detectedsrc/gep/prompt.js:1 · Unicode escape sequence detected — may contain obfuscated payloads…\x4a')+_0x1b20a9(0x41d,'\x71\x6f\x51\x59')+_0x1b20a9(0x1e6,'\x6b\x24\x4a\x30')+'\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501'+_0x1b20a9(0x4c6,'\x69\x6e\x46\x66')+_0x1b20a9(0x304,'\x69\x6e\x46\x66')+_0x1b2…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Process kill commandindex.js:966 · Process kill command — agent can terminate processes' to reduce OOM-kill priority.');Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsrc/adapters/scripts/evolver-task-recall.js:89 · Process kill command — agent can terminate processes// timeout (5000ms) so the host can never kill us mid-write. If stdin neverFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/gep/skill2gep.js:438 · npx invocation of non-well-known package — may execute untrusted code+ 'GEP validation only permits "node "/"npm "/"npx " prefixes. 'Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstest/a2aProtocol.test.js:943 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenvPath: '.env.local',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/gep/skill2gep.js:417 · npx invocation of non-well-known package — may execute untrusted code// validateSynthesizedGene will later apply (node/npm/npx only). Per theFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstest/a2aProtocol.test.js:883 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenvPath: '.env.local',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/hubFetch.test.js:181 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert.equal(safe.includes(rawEnvPath), false, '.env path must not survive string redaction');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagetest/forceUpdateLastUpdateReport.test.js:831 · npx invocation of non-well-known package — may execute untrusted codeassert.equal(payload.error, 'degit_failed: spawn npx ENOENT');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstest/lifecycleStaleNodeSecret.test.js:96 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert.strictEqual(logText.includes(raw.envPath), false, 'raw .env path must not be logged');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Credential pass-through configurationtest/lifecycleProxyHealth.test.js:204 · Credential pass-through configuration — agent relays sensitive credentialsit('reports missing proxy token as unhealthy when proxy mode is expected', () => {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Access to sensitive file pathstest/lifecycleStaleNodeSecret.test.js:869 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenvPath: '.env.local',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandtest/helpers/symlink.js:75 · File permission modification command — agent changes file ownership/permissions// Write succeeded — chmod did not actually enforce read-only.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Access to sensitive file pathstest/dotenvLoadOrder.test.js:56 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files+ 'Only ./src/gep/paths is allowed there (for resolving .env path).'Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/forceUpdateKeepList.test.js:64 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfs.writeFileSync(path.join(tmpTarget, '.env'), 'A2A_NODE_SECRET=from-release\n', 'utf8');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Credential pass-through configurationtest/hubUrlTlsEnforcementConsistency.test.js:246 · Credential pass-through configuration — agent relays sensitive credentialsexports: { getProxyUrl: () => null, getProxyToken: () => null },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Access to sensitive file pathstest/lifecycleNodeIdUnification.test.js:271 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfs.writeFileSync(path.join(evomap, 'node_id'), 'node_../etc/passwd', { mode: 0o600 });Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/evolveSessionsDir.test.js:3 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// process.env.AGENT_SESSIONS_DIR (commonly set in .env) is honored.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Credential pass-through configurationtest/forceUpdateMidCopyWedge.test.js:445 · Credential pass-through configuration — agent relays sensitive credentialsassert.doesNotMatch(result.stderr, /\[proxy-token\] no active proxy token/,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Access to sensitive file pathstest/evolveCollect.test.js:838 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files...env,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandtest/evolveCollect.test.js:12 · File permission modification command — agent changes file ownership/permissions// Tests that rely on `chmod 0o555` actually preventing writes need aFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Access to sensitive file pathstest/hubFetch.test.js:158 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst rawEnvPath = '.env.local';Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagetest/forceUpdateFailureCodes.test.js:269 · npx invocation of non-well-known package — may execute untrusted codeit('fallback download failure reports fallback terminal telemetry with primary npx context first', () => {Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagetest/forceUpdateLastUpdateReport.test.js:825 · npx invocation of non-well-known package — may execute untrusted code{ updated: false, failure: { ok: false, code: 'degit_failed', detail: 'spawn npx ENOENT' } }Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandtest/lifecycleForceUpdateTrigger.test.js:54 · Process kill command — agent can terminate processes// a "success" path does not actually kill the test runner.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstest/forceUpdateKeepList.test.js:210 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesit('preserves .env, .env.local, USER.md, .evolver/ and replaces old code files', () => {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/forceUpdateKeepList.test.js:65 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfs.writeFileSync(path.join(tmpTarget, '.env.local'), 'DEBUG=from-release\n', 'utf8');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/dotenvLoadOrder.test.js:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// .env value (not a stale cache / fallback).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagetest/forceUpdateFailureCodes.test.js:273 · npx invocation of non-well-known package — may execute untrusted codethrow Object.assign(new Error('spawnSync npx ENOENT'), { code: 'ENOENT' });Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandtest/helpers/symlink.js:78 · File permission modification command — agent changes file ownership/permissions// Write failed as expected — chmod is honoured.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Access to sensitive file pathstest/lifecycleStaleNodeSecret.test.js:819 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenvPath: '.env.local',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/lifecycleStaleNodeSecret.test.js:603 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenvPath: '.env.local',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandtest/evolveCollect.test.js:13 · File permission modification command — agent changes file ownership/permissions// filesystem that honours POSIX mode bits. Windows accepts the chmodFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandtest/hubVerifyOfflinePermitRace.test.js:246 · Process kill command — agent can terminate processes// Best-effort cleanup: kill the holder so the test process exits cleanly.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstest/localStateAwareness.test.js:109 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert.ok(joined.includes('.env file:'));Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/lifecycleStaleNodeSecret.test.js:645 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenvPath: '.env.local',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/evolveCollect.test.js:171 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files...env,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/dotenvLoadOrder.test.js:47 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// which is needed to resolve the .env file location and has zeroFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/dotenvLoadOrder.test.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Regression guard for #460: index.js must load `.env` BEFORE anyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagetest/forceUpdateKeepList.test.js:77 · npx invocation of non-well-known package — may execute untrusted codereturn makeDegitFailureThenTarballSuccess(version, Object.assign(new Error('spawnSync npx ENOENT'), {Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstest/localStateAwareness.test.js:105 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesit('reports .env file status', () => {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandtest/experimentAgentRunner.test.js:31 · Process kill command — agent can terminate processessetInterval(() => {}, 1000); // keep alive until the kill landsFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstest/cycleHardTimeout.test.js:83 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/parseMs\(process\.env\.EVOLVER_CYCLE_TIMEOUT_MS,\s*2700000\)/,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagetest/forceUpdateIdempotent.test.js:11 · npx invocation of non-well-known package — may execute untrusted code// 1. transient Channel 1 failures (npx unavailable, network blip, EBUSY)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstest/forceUpdateKeepList.test.js:160 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfs.writeFileSync(path.join(root, '.env.local'), 'DEBUG=1\n', 'utf8');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Credential pass-through configurationtest/hubUrlTlsEnforcementConsistency.test.js:503 · Credential pass-through configuration — agent relays sensitive credentialsgetProxyToken: () => null,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Access to sensitive file pathstest/dotenvLoadOrder.test.js:35 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files+ 'a2aProtocol reads A2A_NODE_SECRET before .env is loaded and may 'Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/cycleHardTimeout.test.js:75 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/parseBoolEnv\(process\.env\.EVOLVER_CYCLE_TIMEOUT_ENABLED,\s*true\)/,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/lifecycleNodeIdUnification.test.js:265 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// legacy file like `node_../etc/passwd` would yield a suffix likeFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/hubUrlResolution.test.js:100 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// #580 Bug 1: a `.env` value with surrounding whitespace (common with aFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Credential pass-through configurationtest/hubUrlTlsEnforcementConsistency.test.js:443 · Credential pass-through configuration — agent relays sensitive credentialsexports: { getProxyUrl: () => null, getProxyToken: () => null },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
npx invocation of non-well-known packagetest/forceUpdateKeepList.test.js:365 · npx invocation of non-well-known package — may execute untrusted codethrow Object.assign(new Error('spawnSync npx ENOENT'), { code: 'ENOENT' });Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Credential pass-through configurationtest/hubUrlTlsEnforcementConsistency.test.js:384 · Credential pass-through configuration — agent relays sensitive credentialsexports: { getProxyUrl: () => null, getProxyToken: () => null },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Access to sensitive file pathstest/forceUpdateKeepList.test.js:159 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfs.writeFileSync(path.join(root, '.env'), 'A2A_HUB_URL=https://hub.example.com\nA2A_NODE_SECRET=s3cr3t\n', 'utf8');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Credential pass-through configurationtest/hubUrlTlsEnforcementConsistency.test.js:317 · Credential pass-through configuration — agent relays sensitive credentialsexports: { getProxyUrl: () => null, getProxyToken: () => null },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Access to sensitive file pathstest/paths.test.js:193 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// .env loading in index.js happens AFTER a first getRepoRoot() callFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Slack token pattern detectedtest/sanitize.test.js:65 · Slack token pattern detected — possible hardcoded or harvested tokenassert.ok(redactString('xoxp-1234567890-abcdefghij').includes(REDACTED),Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Access to sensitive file pathstest/sandboxExecutor.security.test.js:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'node idx.js $(cat /etc/passwd)',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Credential pass-through configurationtest/proxyTokenReuse.test.js:349 · Credential pass-through configuration — agent relays sensitive credentialsassert.notEqual(info.token, 'local-upstream-token', 'bare loopback upstream token must not be reused as proxy token');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
URL with embedded credentialstest/sanitize.test.js:57 · URL with embedded credentials — may be phishing or credential leakingvar urlResult = redactString('https://user:[email protected]/repo');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
GitHub token pattern detectedtest/sanitize.test.js:25 · GitHub token pattern detected — possible hardcoded or harvested tokenassert.ok(redactString('use ghs_abcdefghijklmnopqrstuvwxyz1234567890 for auth').includes(REDACTED),Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
AWS access key pattern detectedtest/sanitize.test.js:29 · AWS access key pattern detected — possible hardcoded or harvested keyassert.ok(redactString('AKIAIOSFODNN7EXAMPLE').includes(REDACTED),Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Access to sensitive file pathstest/paths.test.js:194 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// (used to locate the .env file). If EVOLVER_REPO_ROOT is set only byFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandtest/proxySettings.test.js:125 · Process kill command — agent can terminate processesprocess.kill = (pid, signal) => {Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstest/paths.test.js:195 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// that .env, we must re-read process.env on subsequent calls andFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandtest/questionGenerator.test.js:56 · Process kill command — agent can terminate processesit('honors EVOLVER_EXPLORATION_QUESTIONS=0 kill switch', () => {Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
URL with embedded credentialstest/proxyOpenAIResponses.test.js:241 · URL with embedded credentials — may be phishing or credential leaking'https://user:[email protected]/v1',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
File permission modification commandtest/proxySettings.test.js:25 · File permission modification command — agent changes file ownership/permissions// Redirect the global ~/.evolver/ path into our tmpDir so chmod / fileFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandtest/proxySettings.test.js:70 · File permission modification command — agent changes file ownership/permissionsskip: process.platform === 'win32' ? 'chmod not enforced on Windows' : false,Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
GitHub token pattern detectedtest/sanitize.test.js:19 · GitHub token pattern detected — possible hardcoded or harvested tokenassert.ok(redactString('ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx1234').includes(REDACTED),Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Access to sensitive file pathstest/sanitize.test.js:208 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// `.env` references — prose mentions are NOT redacted; real paths still are.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/paths.test.js:209 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Simulate .env being loaded now and setting the override.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/resetLocalSecret.test.js:35 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv: { ...process.env, HOME: home, ...env },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagetest/sandboxExecutor.security.test.js:48 · npx invocation of non-well-known package — may execute untrusted codetest('ALLOWED_EXECUTABLES contains only node (GHSA-jxh8-jh77-xh6g: npm/npx removed)', () => {Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagetest/proxyServer.test.js:513 · npx invocation of non-well-known package — may execute untrusted codeassert.match(gene.validation[0], /^node |^npm |^npx /, 'validation must be node/npm/npx');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandtest/mailboxStore.test.js:385 · File permission modification command — agent changes file ownership/permissionsskip: process.platform === 'win32' ? 'chmod not enforced on Windows' : false,Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Credential pass-through configurationtest/proxySettings.test.js:85 · Credential pass-through configuration — agent relays sensitive credentialsit('proxy-token command prints only the local proxy token', () => {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Destructive command against a filesystem root or devicetest/sandboxExecutor.security.test.js:25 · Destructive command against a filesystem root or device'node idx.js; rm -rf /',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Slack token pattern detectedtest/sanitize.test.js:63 · Slack token pattern detected — possible hardcoded or harvested tokenassert.ok(redactString('xoxb-1234567890-abcdefghij').includes(REDACTED),Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Credential pass-through configurationtest/proxyTokenReuse.test.js:474 · Credential pass-through configuration — agent relays sensitive credentialsconst staleProxyToken = fakeHexToken('5e');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Access to sensitive file pathstest/sandboxExecutor.security.test.js:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'node idx.js `cat /etc/passwd`',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/localStateAwareness.test.js:113 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfs.writeFileSync(path.join(tmpDir, '.env'), 'A2A_NODE_ID=test\n');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Credential pass-through configurationtest/proxyTracePlatformInstall.test.js:87 · Credential pass-through configuration — agent relays sensitive credentialsassert.doesNotMatch(helper, /Write-Host .*proxyToken/);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
GitHub token pattern detectedtest/sanitize.test.js:109 · GitHub token pattern detected — possible hardcoded or harvested tokensummary: 'Fixed auth using ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx5678',Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Access to sensitive file pathstest/sanitize.test.js:211 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'Read from `.env` file',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
GitHub token pattern detectedtest/sanitize.test.js:21 · GitHub token pattern detected — possible hardcoded or harvested tokenassert.ok(redactString('gho_abcdefghijklmnopqrstuvwxyz1234567890').includes(REDACTED),Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Slack token pattern detectedtest/sanitize.test.js:67 · Slack token pattern detected — possible hardcoded or harvested tokenassert.ok(redactString('xoxa-2-abc-def-ghi-j1234567').includes(REDACTED),Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Access to sensitive file pathstest/localStateAwareness.test.js:112 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesit('detects .env file when present', () => {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/rollbackSafety.test.js:104 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/process\.env\.EVOLVER_ROLLBACK_MODE\s*\|\|\s*['"]stash['"]/,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/rollbackSafety.test.js:109 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/process\.env\.EVOLVER_ROLLBACK_MODE\s*\|\|\s*['"]hard['"]/,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Credential pass-through configurationtest/proxyTokenReuse.test.js:473 · Credential pass-through configuration — agent relays sensitive credentialsit('removes an explicitly managed old local proxy token from upstream credentials', async () => {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Credential pass-through configurationtest/proxyTokenReuse.test.js:166 · Credential pass-through configuration — agent relays sensitive credentialsassert.equal(info.token, oldToken, 'client-held local proxy token must survive proxy settings loss');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Credential pass-through configurationtest/proxyTokenReuse.test.js:180 · Credential pass-through configuration — agent relays sensitive credentialsit('does not reuse or write proxy token when CLAUDE_SETTINGS_FILE points inside a workspace', async () => {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Access to sensitive file pathstest/sanitize.test.js:210 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesredactString('Read from `.env` file'),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandtest/proxySettings.test.js:62 · File permission modification command — agent changes file ownership/permissionsskip: process.platform === 'win32' ? 'chmod not enforced on Windows' : false,Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packagetest/sandboxExecutor.security.test.js:53 · npx invocation of non-well-known package — may execute untrusted codetest('ALLOWED_EXECUTABLES rejects npm and npx (lifecycle-script RCE class)', () => {Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandtest/mailboxStore.test.js:407 · File permission modification command — agent changes file ownership/permissionsskip: process.platform === 'win32' ? 'chmod not enforced on Windows' : false,Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packagetest/sandboxExecutor.security.test.js:54 · npx invocation of non-well-known package — may execute untrusted code// Both npm and npx execute arbitrary code by design (preinstall/install/Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandtest/resolveWorkspaceId.test.js:79 · File permission modification command — agent changes file ownership/permissions// chmod does, so fs.statSync().mode does not round-trip 0o600 on win32.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Destructive file system command detectedtest/sandboxExecutor.security.test.js:25 · Destructive file system command detected'node idx.js; rm -rf /',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Credential pass-through configurationtest/proxyTracePlatformInstall.test.js:81 · Credential pass-through configuration — agent relays sensitive credentialsassert.match(helper, /\$env:ANTHROPIC_AUTH_TOKEN = \$proxyToken/);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Process kill commandtest/proxySettings.test.js:145 · Process kill command — agent can terminate processesprocess.kill = realKill;Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstest/sanitize.test.js:212 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'prose mention of .env in backticks must NOT be redacted'Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagetest/skillDistiller.test.js:353 · npx invocation of non-well-known package — may execute untrusted codeit('does not mention npm or npx as allowed validation prefixes', () => {Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Destructive command against a filesystem root or devicetest/solidify-helpers.test.js:213 · Destructive command against a filesystem root or deviceassert.equal(isValidationCommandAllowed('node test.js && rm -rf /'), false);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive file system command detectedtest/solidify-helpers.test.js:213 · Destructive file system command detectedassert.equal(isValidationCommandAllowed('node test.js && rm -rf /'), false);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive file system command detectedtest/signals.test.js:582 · Destructive file system command detectedassert.deepEqual(_extractLLM('"; rm -rf /'), ['capability_gap']);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive file system command detectedtest/skillDistiller.test.js:233 · Destructive file system command detectedvalidation: ['node test.js', 'rm -rf /', 'echo $(whoami)', 'npm test'],Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstest/sanitize.test.js:215 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesredactString('the .env file is gitignored'),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive command against a filesystem root or devicetest/solidify-helpers.test.js:255 · Destructive command against a filesystem root or deviceassert.equal(isValidationCommandAllowed('rm -rf /'), false);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive command against a filesystem root or devicetest/signals.test.js:582 · Destructive command against a filesystem root or deviceassert.deepEqual(_extractLLM('"; rm -rf /'), ['capability_gap']);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstest/syncEngineLoopResilience.test.js:109 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert.equal(text.includes(raw.envPath), false, 'raw .env path must not be surfaced');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagetest/solidify-helpers.test.js:242 · npx invocation of non-well-known package — may execute untrusted code// npx fetches and runs remote package `bin` entries -- arbitrary code.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagetest/solidify-helpers.test.js:243 · npx invocation of non-well-known package — may execute untrusted codeassert.equal(isValidationCommandAllowed('npx vitest run'), false);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagetest/solidify-helpers.test.js:241 · npx invocation of non-well-known package — may execute untrusted codeit('blocks npx commands (GHSA-jxh8-jh77-xh6g)', () => {Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstest/syncEngineLoopResilience.test.js:92 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenvPath: '.env.local',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/solidify-helpers.test.js:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert.equal(isCriticalProtectedPath('.env'), true);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstest/sync-dedup.test.js:64 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv: { ...process.env, EVOMAP_HUB_ALLOW_INSECURE: '1', ...env },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagetest/skillDistiller.test.js:359 · npx invocation of non-well-known package — may execute untrusted codeassert.ok(!prompt.includes('"npx "'), 'prompt must not suggest npx as valid prefix');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagetest/skill2gep.test.js:114 · npx invocation of non-well-known package — may execute untrusted code// pytest is not on the node/npm/npx allow-list, so nothing is runnable.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstest/sessionStartScope.test.js:91 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv: { PATH: process.env.PATH, ...env },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive file system command detectedtest/solidify-helpers.test.js:255 · Destructive file system command detectedassert.equal(isValidationCommandAllowed('rm -rf /'), false);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive command against a filesystem root or devicetest/skillDistiller.test.js:233 · Destructive command against a filesystem root or devicevalidation: ['node test.js', 'rm -rf /', 'echo $(whoami)', 'npm test'],Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiontest/solidify-helpers.test.js:55 · File type combined with upload action — agent may exfiltrate local data filesexcludeExact: ['event.json', 'temp_gep_output.json'],Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈2,188 tok
1 file · 429 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Reads credential paths from the home directory≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  2. Unclaimed publisher≈ +8 on the totalClaim autogame-17: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. Hex-encoded string detected≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim autogame-17Propose a patch to the maintainer