evolver is an AI agent skill, created by OpenClaw and published at openclaw/skills. ClawSecure audited evolver across 66 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 0/100 (High Risk). The 205 findings concentrate in Data Exfiltration, Command Injection and Malicious Code, including Pattern detected: require('child_process') and Pattern detected: require('child_process'). 187 were rated high or critical severity.
Is evolver safe?
ClawSecure audited evolver and assigned a security score of 0/100 (High Risk), identifying 205 findings across Data Exfiltration and Command Injection. Review the findings below before installing.
What did ClawSecure find in evolver?
ClawSecure identified 205 findings in evolver, concentrated in Data Exfiltration, Command Injection and Malicious Code. 187 were rated high or critical severity. The most severe include Pattern detected: require('child_process') and Pattern detected: require('child_process').
How was evolver audited?
ClawSecure ran evolver through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 66 files from openclaw/skills.
What does a score of 0 mean?
ClawSecure assigned evolver a security score of 0/100, placing it in the High Risk range. This is driven by 205 findings led by Data Exfiltration that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).
Audit Findings for evolver
ClawSecure detected 205 security findings in evolver, spanning Data Exfiltration, Command Injection, Malicious Code and Policy Violation.
- critical · Pattern detected: require('child_process'). Command Injection finding detected in
index.js:7. - critical · Pattern detected: require('child_process'). Command Injection finding detected in
index.js:283. - critical · Pattern detected: execSync(. Command Injection finding detected in
index.js:304. - critical · Pattern detected: execSync(. Command Injection finding detected in
index.js:305. - critical · Pattern detected: execSync(. Command Injection finding detected in
index.js:306. - critical · Pattern detected: execSync(. Command Injection finding detected in
index.js:385. - critical · Pattern detected: execSync(. Command Injection finding detected in
index.js:386. - critical · Pattern detected: require('child_process'). Command Injection finding detected in
scripts/build_public.js:3. - critical · Pattern detected: execSync(. Command Injection finding detected in
scripts/build_public.js:170. - critical · Pattern detected: require('child_process'). Command Injection finding detected in
scripts/generate_history.js:1. - critical · Pattern detected: execSync(. Command Injection finding detected in
scripts/generate_history.js:17. - critical · Pattern detected: require('child_process'). Command Injection finding detected in
scripts/publish_public.js:1.
Showing the 12 highest-severity of 205 findings. The full interactive list appears below.
3-Layer Audit Protocol
Security Recommendations for evolver
Audit external network connections
Harden command execution
Resolve policy violations
Related Security Research
ClawHavoc Explained: The Malware Family Targeting AI Agents→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→Related AI Agent Security Audits
Scanned on March 6, 2026. evolver is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.