Repo2

A self-evolution engine for AI agents. Analyzes runtime history to identify improvements and applies protocol-constrained evolution.

This skill is a full self‑evolver: it scans your agent logs, can write patches to the repository, execute validation commands (limited to node/npm/npx by its safety checks), and can run as a continuous daemon that restarts itself. Before installing or running it: - Treat it like a privileged code runner: do not run it in a production workspace with sensitive credentials or irreplaceable data. - Keep EVOLVE_ALLOW_SELF_MODIFY unset/false unless you intentionally want the evolver to change its own source. Prefer --review (human‑in‑the‑loop) when testing. - Inspect src/gep/solidify.js, src/gep/a2aProtocol.js and the asset promotion scripts to confirm (a) what external endpoints/transports are used and (b) what files can be modified. The a2aProtocol and promotion paths can publish assets externally if configured; disable that unless you trust the network. - Remove or vault any credentials (GITHUB_TOKEN, GH_TOKEN, any service tokens) from the environment where you run the evolver. Assume it will try to use available tokens for publishing if configured. - Run first in an isolated sandbox or disposable VM, with a read‑only copy of any important repo, to observe behavior and verify the 'validation' gating is enforced as you expect. - If you need a safer evaluation: run node index.js --review and trace what candidate patches it proposes; review asset promotion steps before using scripts that auto‑promote or publish. Summary: the skill appears to be what it claims but carries significant autonomous power (self‑patching, looped execution, external publish) that is proportionally risky. Proceed only with review mode, sandboxing, and removing/vaulting credentials.

Type: OpenClaw Skill Name: repo2 Version: 1.0.0 The Capability Evolver is a meta-skill designed for autonomous self-improvement, which involves high-risk capabilities such as self-modification of code and execution of shell commands. While the bundle includes robust safety mechanisms—including a credential redactor (src/gep/sanitize.js), a command whitelist for validations (src/gep/solidify.js), and 'constitutional ethics' prompt guards—it remains suspicious due to the inherent risk of its core functions. Specifically, it communicates with an external hub (evomap.ai) to fetch 'tasks' and 'lessons' (src/gep/taskReceiver.js) and can autonomously trigger 'npm install' on other skills (src/ops/skills_monitor.js), which could be leveraged for persistence or supply chain attacks if the external inputs or the evolution logic are compromised.