by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's declared purpose (self-evolution by scanning workspace logs and applying 'genes') matches what the code and instructions do, but the bundled script runs as a background daemon, reads and writes files across the workspace, and the distributed code is only partially visible here—so there is non-trivial risk and some unresolved inconsistencies that merit manual review before installing.
评估建议
This skill generally does what it says (scans workspace logs, matches gene templates, and records suggested fixes), but it runs code that reads arbitrary files under your workspace and can write persistent changes (CAPSULES.md, evolver-state.json, PID file) and run as a background loop. Before installing: 1) Inspect the full evolve.js implementation (the bundled file is large—ensure there are no hidden network calls, execs, or unexpected behaviors later in the file); 2) Run it in dry-run (--dry-...详细分析 ▾
✓ 用途与能力
The name/description (self-evolution engine that scans logs, matches gene templates, and records fixes) align with the SKILL.md and the included bin/evolve.js: the script detects signals in a workspace 'memory' directory, matches GENES.md, and appends validated fixes (capsules). Required resources (none declared) are consistent with the described behavior.
⚠ 指令范围
SKILL.md instructs running the node script, including daemon/loop and review modes. The script reads files from the workspace (WORKSPACE_DIR -> memory/*.md), loads/writes assets/ files (GENES.md, CAPSULES.md, evolver-state.json, pid file), and can run continuously. While this is consistent with 'scan workspace memory/logs', it means the skill will access arbitrary files in the workspace and persist changes to repo files; any agent-autonomous runs or daemon execution could make persistent modifications. The SKILL.md claims removed network/execution features, but the code still imports child_process.spawn and the file header references features (fetch/autoIssue) that the changelog says were removed—an inconsistency to review.
✓ 安装机制
No install spec (instruction-only install) and the repository includes the script itself. Nothing is downloaded or extracted at install time, which lowers install-time risk.
✓ 凭证需求
The skill declares no environment variables or credentials and the visible code does not reference external secrets. There are no outsized credential requests in metadata. However, the Genes include strategies that reference API keys and token refresh logic (in plain text in GENES.md) as guidance—these are templates, not direct requests, but they indicate the skill may be used to modify auth logic if applied.
⚠ 持久化与权限
The skill can be run as a background daemon, create a PID file, update state and append to CAPSULES.md (i.e., persistent writes). While 'always: false' and autonomous invocation are default, the combination of autonomous invocation + ability to continuously scan workspace files and write diffs/capsules increases blast radius if the code performs unintended modifications or network actions. The skill does not declare elevated platform privileges but persistent file writes across the repo are significant.
⚠ bin/evolve.js:392
Shell command execution detected (child_process).
⚠ bin/evolve.js:480
Environment variable access combined with network send.
⚠ bin/evolve.js:68
File read combined with network send (possible exfiltration).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv3.0.02026/4/16
ciri-evolver v3.0.0 - Major change: Removed fetchSkill and autoIssue functions for improved safety and simplicity. - Safer by eliminating internal exec/fetch operations. - Documentation and help text updated for clarity and focus. - File structure, error signal support, and evolution strategies remain as before.
● Pending
安装命令
点击复制官方npx clawhub@latest install ciri-evolver
镜像加速npx clawhub@latest install ciri-evolver --registry https://cn.longxiaskill.com
技能文档
Version: 3.0.0
License: GNU General Public License v3.0 (GPL-3.0)
Copyright: 2026
Open Source Attribution | 开源许可与归属
- Inspired by GEP (Genome Evolution Protocol)
- Independent OpenClaw Implementation
bin/evolve.js) is independently developed for OpenClaw.Full license text: see LICENSE.
Quick Start | 快速开始
Install
clawhub install ciri-evolver
Run
# Single evolution scan node skills/evolver/bin/evolve.js
# Test mode (no file writes) node skills/evolver/bin/evolve.js --dry-run
Background Daemon
# Start daemon (auto-runs every 4 hours) node skills/evolver/bin/evolve.js start# Check status node skills/evolver/bin/evolve.js status
# Stop node skills/evolver/bin/evolve.js stop
Core Features | 核心功能
| Feature | Description |
|---|---|
| Signal Detection | Scans memory/ logs for 10+ error patterns |
| Gene Matching | Matches signals to reusable strategy templates |
| Capsule Management | Stores validated fixes with diff + confidence |
| 4 Evolution Strategies | balanced / innovate / harden / repair-only |
| Loop Mode | Continuous background daemon |
| Review Mode | Pause for human confirmation |
| Lifecycle | start / stop / status / check |
| Bootstrap | Auto-creates Gene library on first run |
Supported Error Signals | 支持的错误信号
| Signal | Meaning |
|---|---|
| TimeoutError | Network timeout |
| ECONNREFUSED | Connection refused |
| RateLimitError | Rate limit exceeded |
| AuthError | Authentication failed |
| ContextOverflow | Context memory exceeded |
| ModelFallback | Model routing fallback |
| GatewayTimeout | Gateway timeout |
| ParseError | Parse/syntax error |
| FileNotFound | File not found |
| DeprecationWarning | Deprecated API warning |
Commands | 命令
| Command | Description |
|---|---|
evolve.js | Single run |
evolve.js --dry-run | Test mode |
evolve.js --loop | Continuous loop |
evolve.js --review | Review mode (human confirm) |
evolve.js --strategy= | Set strategy |
evolve.js start | Start daemon |
evolve.js stop | Stop daemon |
evolve.js status | Check status |
evolve.js check | Health check |
Strategies | 策略
| Strategy | Innovate | Optimize | Repair |
|---|---|---|---|
balanced | 50% | 30% | 20% |
innovate | 80% | 15% | 5% |
harden | 20% | 40% | 40% |
repair-only | 0% | 20% | 80% |
File Structure | 文件结构
skills/evolver/
├── SKILL.md # This file
├── LICENSE # GPL-3.0 license
├── bin/
│ └── evolve.js # Core script
└── assets/
├── GENES.md # Gene library (editable)
├── CAPSULES.md # Validated fixes
└── EVOLUTION_EVENTS.md # Evolution logs
Example Output | 示例输出
Evolver - Skill Self-Evolution Engine v3.0Strategy: balanced Mode: SINGLE
Signals detected: ModelFallback Genes: 5 total, 1 matched
================================================================================ GEP Evolution Prompt ================================================================================
Evolution ID: EVT-20260416-ABCD
Strategy: balanced (innovate:0.5 optimize:0.3 repair:0.2)Detected Signals
- ModelFallbackMatched Genes
### [20260416-004] repair Signals: ModelFallback Strategy: Fix model routing issues...Suggested Actions
1. [repair] Fix model routing + log fallback chainEvolution Event Record
{ "type": "EvolutionEvent", ... }
Evolution event recorded.
Troubleshooting | 故障排除
Q: "No such file or directory"? A: Run from correct workspace directory or use absolute path.
Q: Background process gone?
A: Check with evolve.js status, restart with evolve.js check.
Q: No signals detected?
A: Check memory/ directory for logs containing error keywords.
Q: No gene match?
A: Edit assets/GENES.md to add new gene templates.
Changelog | 版本历史
- v3.0.0: Removed fetchSkill and autoIssue functions. Cleaner, safer, no exec/fetch.
- v2.0.3: Code optimizations (regex pre-compilation, path traversal protection)
- v2.0.0: Full feature set (Loop, Review, Lifecycle)
- v1.0.0: Initial release (Signal Detection + Gene Matching)