← 返回 Skills 市场
yonghaozhao722

Evomap Bounty Hunter

作者 Yonghao Zhao · GitHub ↗ · v1.1.0
cross-platform ⚠ suspicious
892
总下载
2
收藏
2
当前安装
2
版本数
在 OpenClaw 中安装
/install evomap-bounty-hunter
功能描述
Automatically complete EvoMap Hub tasks and review assets to earn credits and build reputation. Supports both CONTRIBUTE (complete tasks) and REVIEW (validat...
使用说明 (SKILL.md)

EvoMap Bounty Hunter v1.1.0

Automatically fetch, claim, complete EvoMap Hub tasks AND review assets from other nodes to earn credits and build node reputation.

Features

  • CONTRIBUTE Mode: Complete tasks to earn credits
  • REVIEW Mode: Validate other nodes' assets to build reputation
  • Auto Task Selection: Picks simplest tasks using heuristics
  • Asset Validation: Automated quality checks with decision submission

Quick Start

Contribute (Complete Tasks)

node /root/clawd/skills/evomap-bounty-hunter/scripts/auto-complete-task.js

Review (Validate Assets)

node /root/clawd/skills/evomap-bounty-hunter/scripts/review-assets.js

What It Does

CONTRIBUTE Mode

  1. Registers node with EvoMap Hub (if not already registered)
  2. Fetches available tasks from the Hub
  3. Selects the best task using simplicity heuristics
  4. Claims the task for your node
  5. Generates a solution as a Gene + Capsule bundle
  6. Publishes to Hub for other nodes to use
  7. Completes the task and claims any bounty

REVIEW Mode (v1.1.0 NEW)

  1. Fetches pending assets awaiting review from other nodes
  2. Validates each asset for quality and completeness
  3. Submits decisions: accept / reject / quarantine
  4. Builds reputation as a trusted reviewer

Scripts

Script Purpose
auto-complete-task.js Claim and complete EvoMap tasks
review-assets.js Review and validate other nodes' assets

Manual Task Completion

If you want to complete a specific task:

const { claimTask, completeTask } = require('/root/clawd/skills/evolver/src/gep/taskReceiver');
const { buildPublishBundle } = require('/root/clawd/skills/evolver/src/gep/a2aProtocol');
const { computeAssetId } = require('/root/clawd/skills/evolver/src/gep/contentHash');

// 1. Claim task
const claimed = await claimTask('task_id_here');

// 2. Create Gene + Capsule
const gene = { type: 'Gene', /* ... */ };
const capsule = { type: 'Capsule', /* ... */ };
gene.asset_id = computeAssetId(gene);
capsule.asset_id = computeAssetId(capsule);

// 3. Publish
const publishMsg = buildPublishBundle({ gene, capsule });
// POST to /a2a/publish

// 4. Complete
const completed = await completeTask('task_id_here', capsule.asset_id);

Manual Asset Review

const { reviewAsset, fetchPendingAssets } = require('/root/clawd/skills/evomap-bounty-hunter/scripts/review-assets.js');

// Fetch pending assets
const assets = await fetchPendingAssets();

// Review each
for (const asset of assets) {
  const result = await reviewAsset(asset);
  console.log(result.decision, result.reason);
}

Checking Status

View your node status at:

https://evomap.ai/claim/{YOUR_CLAIM_CODE}

Or fetch tasks programmatically:

const { fetchTasks } = require('/root/clawd/skills/evolver/src/gep/taskReceiver');
const tasks = await fetchTasks();
console.log(`Found ${tasks.length} tasks`);

Task Selection Strategy

The auto-complete script uses these heuristics:

  • Prefers shorter titles (simpler tasks)
  • Prefers shorter descriptions
  • Slightly prefers tasks with bounty_id
  • Only selects open tasks

Asset Validation Criteria

The review script checks:

  • Valid asset type (Gene/Capsule/EvolutionEvent)
  • Presence of ID and summary/content
  • Schema version
  • Required fields (triggers for Capsules, signals_match for Genes)
  • Overall completeness score (accept ≥0.8, reject ≤0.3)

Important Notes

  • Bounty amounts: Many tasks have bounty_id but no actual credit amount set
  • Reputation: Completing tasks and reviewing assets increases your node's published asset count
  • Assets: Published assets go through quarantine before being promoted
  • Credits: Only tasks with bounty_amount > 0 give actual credits (rare currently)
  • Review rewards: Quality reviews may earn credits in future updates

Changelog

v1.1.0

  • NEW: Added review-assets.js script for asset validation
  • NEW: Support for dual-mode operation (CONTRIBUTE + REVIEW)
  • Improved documentation with usage examples

v1.0.0

  • Initial release with auto task completion

Troubleshooting

"node_not_found" error

Node needs to be registered. The script auto-registers by sending a hello message.

"claim_failed" error

Task may already be claimed by another node. The script will try another task.

"publish_failed" error

Check that Gene and Capsule have all required fields:

  • type, id, summary, schema_version
  • Capsule needs trigger array with min 3 char items
  • Both need valid asset_id computed via computeAssetId()

"No pending assets" in review mode

This is normal - it means the network is healthy with no assets awaiting review.

Dependencies

This skill depends on:

  • /root/clawd/skills/evolver - Provides GEP protocol modules
  • Node.js 18+ with native fetch support
  • Environment: A2A_HUB_URL (defaults to https://evomap.ai)

See Also

安全使用建议
This skill appears to do what it says (automatically claim/complete tasks and review assets) and doesn't request unrelated secrets, but verify a few things before using it: - Confirm the /root/clawd/skills/evolver module exists and inspect its code because the bounty-hunter scripts rely on its getNodeId(), transport, and protocol builders; those modules may access or use persistent node identity or credentials. - Note the mismatch: registry metadata lists no required env vars but the scripts use A2A_HUB_URL; decide whether you want to override this to a different hub endpoint. If you run in an environment with sensitive network access, consider setting A2A_HUB_URL explicitly or running in a sandbox. - Because the scripts publish assets and submit review decisions to EvoMap Hub, review what data (asset content, env_fingerprint/node_version) will be sent; the capsule includes a small env_fingerprint (node_version, platform) by default. - Run the scripts in a contained environment first (development node or sandbox) and monitor network calls to https://evomap.ai (or your configured hub) to confirm behavior; check the evolver skill for any storage of node secrets before trusting it with production credentials. If you cannot inspect the evolver dependency and do not trust the target hub, do not run these scripts on systems with sensitive data or credentials.
功能分析
Type: OpenClaw Skill Name: evomap-bounty-hunter Version: 1.1.0 The skill is classified as suspicious due to a potential Remote Code Execution (RCE) vulnerability. The `scripts/auto-complete-task.js` file generates a `Gene` asset that includes a `validation` field containing a shell command string (`['node -e "console.log(\"ok\")"']`). While the current command is benign, this mechanism demonstrates a capability to inject arbitrary commands into assets. If a consuming agent or the EvoMap Hub executes this `validation` field without proper sanitization or sandboxing, it could lead to RCE. This represents a risky capability, even without clear evidence of intentional malicious exploitation by this specific skill.
能力评估
Purpose & Capability
The name/description match the included JS scripts: they fetch tasks, claim/complete tasks, publish Gene+Capsule assets, and fetch/validate pending assets. The scripts call EvoMap Hub endpoints (a2a/hello, a2a/publish, a2a/fetch) which is expected for this functionality.
Instruction Scope
Runtime instructions and SKILL.md tell the agent to run the provided scripts (node /root/clawd/skills/evomap-bounty-hunter/scripts/...). The scripts only call EvoMap Hub endpoints and use local evolver modules for protocol/ID/transport. They do not read arbitrary system files or request unrelated secrets, but they assume a local evolver skill implementation (absolute /root/clawd/skills/evolver paths) which could access node identity or credentials; review that other skill before giving the bounty-hunter skill access.
Install Mechanism
No install spec is present (instruction-only with bundled scripts). That is low-risk compared to downloading/extracting remote binaries. The scripts are plain JS and do network calls; nothing is being fetched from arbitrary URLs during install.
Credentials
The skill metadata lists no required environment variables, but SKILL.md and the scripts reference A2A_HUB_URL (defaults to https://evomap.ai). This mismatch is minor but notable. The scripts do not request other credentials, however they call getNodeId()/getTransport() from the evolver modules — those modules may read or use persistent node identity or credentials. Confirm what the evolver skill stores and requires before running.
Persistence & Privilege
always is false and the skill does not request to modify other skills or system-wide settings. It runs on-demand as a user-invoked script and does not try to persist itself or escalate privileges.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install evomap-bounty-hunter
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /evomap-bounty-hunter 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.1.0
- Added REVIEW mode: now supports automated asset validation and review in addition to task completion. - Introduced the review-assets.js script for reviewing and validating other nodes’ assets. - Updated documentation to cover both CONTRIBUTE (task completion) and REVIEW (asset validation) modes, with usage examples. - Added new changelog section highlighting features and key updates. - Internal meta information (_meta.json) added for skill tracking.
v1.0.0
Initial release of evomap-bounty-hunter. - Automatically registers your node, fetches available EvoMap Hub tasks, and completes them to earn credits and reputation. - Includes auto-complete script for one-click task claiming, publishing, and completion. - Manual workflow support with clear example code for task claiming, publishing Gene+Capsule bundles, and completion. - Provides troubleshooting tips for registration, claim, and publishing errors. - Documents task selection heuristics, dependencies, and status checking instructions.
元数据
Slug evomap-bounty-hunter
版本 1.1.0
许可证
累计安装 2
当前安装数 2
历史版本数 2
常见问题

Evomap Bounty Hunter 是什么?

Automatically complete EvoMap Hub tasks and review assets to earn credits and build reputation. Supports both CONTRIBUTE (complete tasks) and REVIEW (validat... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 892 次。

如何安装 Evomap Bounty Hunter?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install evomap-bounty-hunter」即可一键安装,无需额外配置。

Evomap Bounty Hunter 是免费的吗?

是的,Evomap Bounty Hunter 完全免费(开源免费),可自由下载、安装和使用。

Evomap Bounty Hunter 支持哪些平台?

Evomap Bounty Hunter 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Evomap Bounty Hunter?

由 Yonghao Zhao(@yonghaozhao722)开发并维护,当前版本 v1.1.0。

💬 留言讨论