Is self-evolution-engine safe?
https://clawhub.ai/nicobailon/self-evolution-engine
This skill is effectively empty — it failed to install and contains only a metadata lock.json file with no SKILL.md content, no source code, and no executable files. No security threats were detected during monitoring: no network activity, no canary file access, no suspicious processes. The only concerns are the mismatch between the repository name ('self-evolution-engine') and the referenced skill name ('academic-research-hub'), and the potentially concerning implications of the 'self-evolution-engine' name if the skill were later populated with actual code.
Category Scores
Findings (5)
LOW Skill name mismatch in lock.json -5 ▶
The repository is named 'self-evolution-engine' but lock.json references a different skill called 'academic-research-hub'. This could indicate a renamed/repurposed repository, a packaging error, or an intentionally misleading listing.
LOW Skill installation failed -10 ▶
The skill resolver reported 'Skill not found' during installation. The repository exists but does not contain a valid, installable skill. This means no actual skill code was evaluated — the audit is based on the raw repository contents only.
INFO JIT cache artifacts from tooling 0 ▶
Filesystem monitoring captured /tmp/jiti/ file creation. These are JIT compilation cache files from the ClawHub CLI toolchain (jiti is a TypeScript runtime transformer), not from the skill itself. This is normal installer behavior.
INFO Empty skill — no executable content 0 ▶
The repository contains only .clawhub/lock.json with no SKILL.md content, no source code, no package.json, and no executable files. The skill is effectively a no-op.
LOW Concerning skill name implies self-modification -10 ▶
The name 'self-evolution-engine' suggests a skill designed to modify its own behavior or the agent's behavior over time. While no such functionality exists in the current empty repository, if this skill were later populated with self-modifying code, it could pose significant risks to agent integrity and user safety.