Self Evolving Skill 1.0.2

Meta-cognitive self-learning system - Automated skill evolution based on predictive coding and value-driven mechanisms.

This package is inconsistent: it advertises a Python ML core and an MCP server but those core Python files are not included. Before installing or enabling it: 1) Do NOT add the suggested mcp_servers.json auto-start entry until you have inspected the actual mcp_server.py and core/ modules. 2) Inspect any storage implementation (core/storage.py) for pickling/deserialization of arbitrary objects — loading untrusted pickles can execute code. 3) Check and correct hardcoded paths (the adapter defaults to /Users/blitz/...) so it won't read/write unexpected locations. 4) Prefer installing this only in an isolated environment (container or isolated user) and only after obtaining the missing core source from a trusted origin and reviewing it. 5) If you don't want to run a local Python MCP server, note that the TypeScript side has a JS fallback with static/simulated outputs — expect reduced functionality. If you want a clear pass/fail: include the missing core Python files (or confirm they will be installed by a vetted installer) and re-run the review.

Type: OpenClaw Skill Name: self-evolving-skill-1-0-2 Version: 1.0.0 The skill is classified as suspicious primarily due to a hardcoded storage path in `mcporter_adapter.py` (`/Users/blitz/.openclaw/workspace/self-evolving-skill/storage`), which is a misconfiguration that could lead to unexpected behavior or permission issues in different environments. While the skill legitimately spawns Python processes (`mcp_server.py` via `src/index.ts` and `INSTALLATION.md`) and handles agent-provided `context` for skill execution, the hardcoded path indicates a lack of robustness. There is no clear evidence of intentional malicious activity such as data exfiltration, unauthorized remote control, or persistence mechanisms beyond its stated purpose.