Agent Economy ReportAgent Economy ReportUNSAFE version 1.8.0 · audited 2026-09-17
This package is a Node.js wrapper for a self-evolving agent. It runs evolution cycles by spawning the core evolver and an OpenClaw agent, then reports results to Feishu. It also creates a watchdog cron job, automatically runs git add/commit/push, and can install npm dependencies without asking. Most seriously, the code executes a JavaScript snippet built from child-process output using new Function, which can run arbitrary code in a process that holds Feishu credentials and can spawn paid agent work. Because of that dynamic evaluation and the broad automatic actions, this is unsafe to install as-is.
Instructions try to steer the agent beyond the declared purpose. index.js line 1176 appends `MANDATORY POST-SOLIDIFY STEP (Wrapper Authority -- Cannot Be Skipped)` to the child agent task; index.js lines 970-971 set a report directive with `You MUST use the feishu-evolver-wrapper/report.js tool`; index.js line 1144 executes child stdout as JavaScript via `new Function`.
| Declared purpose | Feishu-integrated wrapper for the capability-evolver. Manages the evolution loop lifecycle (start/stop/ensure), sends rich Feishu card reports, and provides dashboard visualization. Use when running evolver with Feishu reporting or when managing the evolution daemon. |
| Observed behavior | The wrapper spawns the core evolver as a child process, reads its stdout, extracts sessions_spawn payloads, and writes a task file. It then spawns the OpenClaw CLI agent with injected mandatory report/status instructions and retries on failure. After success it performs git add/commit/pull/push automatically, sends Feishu cards/reports/dashboards, exports history to Feishu docs, and creates an OpenClaw cron watchdog plus optional detached daemon processes. It also can auto-run npm install for skills through skills_monitor. |
| Verdict, rules only | CAUTION · runs subprocesses or eval/exec; reads credential-like environment variables: DOC_TOKEN, EVOLVER_ISSUE_DOC_TOKEN, EVOLVE_LOG_DEDUP_MAX_KEYS, FEISHU_EVOLVER_DASHBOARD_DOC_TOKEN, FEISHU_EVOLVER_DOC_TOKEN; touches persistence (cron, shell profile, autostart) |
| Verdict, AI | UNSAFE |
| Final verdict | UNSAFE (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | Sends Feishu cards, reports, dashboards, and history exports to open.feishu.cn; lists Feishu chats to auto-select a report group. |
| shell | needed | Uses child_process execSync/spawn to run node, git, openclaw CLI, ps, which, npm, and shell commands; some commands interpolate env/CLI path values into shell strings. |
| filesystem_read | needed | Reads Feishu token files, .env, evolution events/logs, workspace files, /proc info, and PID/lock state. |
| filesystem_write | needed | Writes PID, lock, log, status, task, report, dashboard, and state files; stages and commits git changes; deletes stale files and logs. |
| credentials | needed | Uses Feishu app ID and bearer token from memory/feishu_token.json, Feishu doc token env vars, and OPENCLAW_MASTER_ID; git push uses repository credentials. |
| persistence | needed | Creates OpenClaw cron job evolver_watchdog_robust and can start detached daemon/watchdog processes that restart the wrapper. |
| install_packages | exceeds purpose | skills_monitor auto-runs npm install for skills with missing node_modules by default, changing dependencies without an explicit operator decision. |
| severity | finding |
|---|---|
| critical | Arbitrary code execution from child process output The wrapper takes stdout from the core evolver child process and, if JSON.parse and key-quoting fail, executes the raw text as JavaScript with new Function after only removing control characters. This runs in the Node process that holds Feishu credentials and can spawn further agents. index.js:1144 const parsed = new Function('return (' + sanitized + ')')(); |
| high | Automatic push to remote main branch After a successful cycle the wrapper stages workspace paths, commits, pulls with rebase, and pushes to origin main automatically. AI-generated changes can leave the local workspace and reach the remote repository without an approval gate. index.js:621 execWithTimeout('git push origin main', gitRoot, 120000); |
| high | Creates persistent OpenClaw cron watchdog The lifecycle code installs or edits a recurring OpenClaw cron job that runs the ensure action. This persists beyond the current process and can restart the wrapper automatically. lifecycle.js:306 const cmdStr = `${openclawCli} cron add --name "evolver_watchdog_robust" --every "30m" --session "isolated" --message "exec: node skills/feishu-evolver-wrapper/ |
| high | Automatic dependency installation for scanned skills skills_monitor autoHeal defaults to on and runs npm install in any skill directory with missing node_modules. This can install or change dependencies without the operator's explicit decision. skills_monitor.js:111 execSync('npm install --production --no-audit --no-fund', { |
| medium | Shell interpolation from OPENCLAW_CLI_PATH OPENCLAW_CLI_PATH is interpolated into execSync shell strings without quoting or array arguments. A malicious or malformed environment value could append shell commands; the same value is used in cron list/add/edit commands. lifecycle.js:264 execSync(`which ${openclawCli}`, { stdio: 'ignore' }); |
| high | Wrapper injects overriding instructions into spawned agent The wrapper adds 'MANDATORY' and 'Wrapper Authority' language to the task it feeds to the OpenClaw agent, and sets EVOLVE_REPORT_DIRECTIVE to require using its report.js tool. This is prompt-injection-style steering that can override the agent's other instructions. index.js:1176 MANDATORY POST-SOLIDIFY STEP (Wrapper Authority -- Cannot Be Skipped) |
| medium | Report target auto-selected by Feishu group name Without an explicit target, the reporter lists Feishu chats and picks the first group whose name contains a DNA emoji. Reports containing workspace-derived status may go to an unintended group if the name matches. report.js:268 const group = data.data.items.find(c => c.name && c.name.includes('🧬')); |
| medium | Raw evolution log uploaded to Feishu document The history exporter reads the local evolution log and uploads chunks to a Feishu doc. It truncates and removes bracketed text, but does not apply the same secret scan used by card sends, so plaintext sensitive data in logs could be exposed. export_history.js:76 const res = await fetch(`https://open.feishu.cn/open-apis/docx/v1/documents/${DOC_TOKEN}/blocks/${DOC_TOKEN}/children`, { |
| medium | Script starts detached background wrapper daemon.sh launches a detached background process with setsid/nohup and writes PID files. This is a secondary persistence mechanism outside the OpenClaw cron path. daemon.sh:37 setsid nohup node "$WRAPPER_SCRIPT" --loop >> "$LOG_DIR/evolver_loop.log" 2>&1 & |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| open.feishu.cn | not in the service index | export_history.js:76 |
| Binaries invoked | bash, crontab, git, node, nohup, npm |
| Environment variables read | APPEND_SCRIPT, BASH_SOURCE, CMDLINE, CREATE_SCRIPT, DOC_TOKEN, EVENTS_FILE, EVOLVER_DIR, EVOLVER_ISSUE_DOC_TOKEN, EVOLVE_BRIDGE, EVOLVE_CIRCUIT_BREAKER_MAX_PAUSE_SEC, EVOLVE_CIRCUIT_BREAKER_PAUSE_SEC, EVOLVE_CIRCUIT_BREAKER_THRESHOLD, EVOLVE_EXTRA_MODES, EVOLVE_FORCE_SIGNAL, EVOLVE_HAND_MAX_RETRIES, EVOLVE_HAND_RETRY_BACKOFF_SECONDS, EVOLVE_HINT, EVOLVE_LOG_DEDUP, EVOLVE_LOG_DEDUP_MAX_KEYS, EVOLVE_LOG_DEDUP_WINDOW_MS, EVOLVE_NOTIFY_LEVEL, EVOLVE_REPORT_DEDUP, EVOLVE_REPORT_DIRECTIVE, EVOLVE_REPORT_LANG, EVOLVE_REPORT_TOOL, EVOLVE_STALE_CYCLE_WINDOW, EVOLVE_TARGET, EVOLVE_WRAPPER_FAIL_BACKOFF_SECONDS, EVOLVE_WRAPPER_LOOP_SLEEP_SECONDS, EVOLVE_WRAPPER_MAX_CYCLES, FEISHU_APP_ID, FEISHU_BOT_NAME, FEISHU_CN_REPORT_GROUP, FEISHU_EVOLVER_DASHBOARD_DOC_TOKEN, FEISHU_EVOLVER_DOC_TOKEN, FEISHU_LOG_TARGET, HAND_MAX_RETRIES_PER_CYCLE, HOME, KILL_SWITCH_FILE, LOG_DEDUP_FILE, LOG_DIR, LOG_TARGET, MEMORY_DIR, NEW_PID, OPENCLAW_BIN, OPENCLAW_CLI_PATH, OPENCLAW_MASTER_ID, OUTPUT_FILE, PID, PIDS, PID_FILE, SCRIPT_DIR, WAKE_FILE, WRAPPER_SCRIPT |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 20 |
| base64 blobs | 0 |
| File writes | 20 |
| Persistence | 3 |
| file | lines | sha256 |
|---|---|---|
README.md | 10 | 97bc88a2c1152bd7… |
SKILL.md | 31 | f5d84210a2d6885b… |
_meta.json | 6 | 74e9b552aa86e3e5… |
check_health.js | 72 | 866ebe8fc9b464d6… |
cleanup.js | 51 | 46e2da27e69c8c1e… |
commentary.js | 37 | 35211871bd9aa5dc… |
daemon.sh | 47 | 9c1acc0ad96ed860… |
exec_cache.js | 25 | 756983c75f233142… |
export_history.js | 99 | d2a3c1733b4f2a78… |
feishu-helper.js | 278 | 6c8d20c23a732372… |
index.js | 1637 | 916d30c955c31342… |
issue_tracker.js | 162 | 476f944769b3e8b8… |
lifecycle.js | 834 | 3597676f0d16fd2e… |
package.json | 9 | 6da9d4192341b12d… |
report.js | 483 | 22905e6326d8c7c2… |
self-repair.js | 62 | 9454800e1f70ca84… |
send-card-cli.js | 31 | 48544bc8edd899c8… |
skill-card.md | 64 | 984c8873b83ddaf1… |
skills_monitor.js | 170 | cb5763c29dac4fec… |
trigger.js | 12 | 75491a0012ad2662… |
utils/dashboard-generator.js | 198 | a76cb229aef55d78… |
utils/logger.js | 33 | 5ef4797cc7b47ba0… |
utils/resolve-evolver.js | 49 | e2317b03200b6b09… |
utils/sleep.js | 15 | e62d866aeb779a7e… |
visualize_dashboard.js | 192 | 5729e1c1b9a7e4b7… |
weekly_insight.js | 135 | f61e3a3e4b220f9a… |
For agents
JSON: https://agenteconomy.report/k/feishu-evolver-wrapper.audit.json · badge: https://agenteconomy.report/k/feishu-evolver-wrapper.audited.svg ·
skill rating: /k/feishu-evolver-wrapper · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).