Skill Auto Evolver

Analyze and improve OpenClaw agent skills by tracking usage, checking skill health, scanning code quality, and generating actionable improvement suggestions....

This package appears to implement the advertised analyzer/monitor/reporter functionality, but I found multiple red flags you should consider before installing: - Source verification: the package's source/homepage is 'unknown' and the registry listed it as instruction-only while the bundle contains code. Prefer installing only from a trusted repository (official OpenClaw repo or a verified release). - Local data access: the tool reads all files under the skills directory (default ~/.openclaw/skills) and writes a SQLite DB to ~/.openclaw/skill-evolver/skill_evolver.db. That is expected for this tool, but any sensitive data accidentally stored inside a skill (API keys, tokens, credentials) could be read and stored in the DB. Inspect your skills for secrets before running a bulk analysis. - Code quality bugs: there are clear implementation issues (examples: truncated/buggy return in database.add_feedback returning an undefined variable 'c'; some function calls in CLI/reporter reference methods like get_all_skills or get_feedback_stats that are not visible in the truncated model and may be missing or buggy). These likely lead to runtime errors. Treat the tool as experimental until you run it in a safe environment. - Installation and execution: because the registry lacks an install spec, prefer installing into a virtualenv, container, or isolated machine. Install dependencies (pip install -r requirements.txt) only after reviewing the code locally. - Mitigations: run the CLI with a non-default skills_dir pointing to a copy of the skills you want to test, inspect the generated DB file, and avoid running as root. If you intend to use it widely, request the upstream source, check commit history, and run tests in a sandbox. If you can provide the canonical source URL (GitHub repo or release tarball) and confirm whether all referenced DB and helper methods are implemented, I can raise or lower the risk assessment. In particular, evidence of networking code, undisclosed external endpoints, or hidden credential access would increase the severity.

Type: OpenClaw Skill Name: skill-auto-evolver Version: 0.1.1 The skill bundle provides a utility for monitoring and analyzing OpenClaw skills, but it contains a SQL injection vulnerability in 'database/models.py' where the 'days' parameter is inserted into SQLite queries using string formatting rather than parameterization. While the tool's ability to read and analyze all files in the '~/.openclaw/skills' directory is aligned with its stated purpose of code quality analysis, this represents a high-privilege capability. No evidence of intentional malice, data exfiltration, or backdoors was identified.