Local DevOps/autonomy skill for OpenClaw (safe evolution loop with guardrails).

This skill is just a thin wrapper that calls a local script (evolvectl.sh). That means the real behavior depends entirely on that script — the registry entry itself contains no code to inspect. Before installing or enabling this skill: 1) locate and inspect the evolvectl.sh the agent would run (or set EVOLVECTL to a vetted path) and verify it does only what you expect; 2) confirm what files/configs the controller will read/write (especially agent/skill configs) and whether it needs elevated privileges; 3) limit agent autonomy or run the skill in a restricted/sandboxed environment until you trust the controller; 4) request source/homepage or a signed release from the author — absence of a homepage and the mismatched metadata version/published timestamp are additional signals to verify origin. If you cannot review the controller script, do not enable autonomous invocation for this skill.

Type: OpenClaw Skill Name: evolve Version: 0.0.2 The skill delegates its core functionality to an external script, `evolvectl.sh`, whose location can be overridden by the `EVOLVECTL` environment variable, as described in `SKILL.md`. This design choice introduces a significant vulnerability for arbitrary code execution, as a compromised `EVOLVECTL` variable or a malicious `evolvectl.sh` could lead the OpenClaw agent to execute untrusted code. While not directly malicious within this bundle, it presents a high-risk attack surface.