evolver is an AI agent skill, created by OpenClaw and published at openclaw/skills. ClawSecure audited evolver across 67 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 0/100 (High Risk). The 212 findings concentrate in Data Exfiltration, Command Injection and Malicious Code, including Pattern detected: require('child_process') and Pattern detected: require('child_process'). 192 were rated high or critical severity.
Is evolver safe?
ClawSecure audited evolver and assigned a security score of 0/100 (High Risk), identifying 212 findings across Data Exfiltration and Command Injection. Review the findings below before installing.
What did ClawSecure find in evolver?
ClawSecure identified 212 findings in evolver, concentrated in Data Exfiltration, Command Injection and Malicious Code. 192 were rated high or critical severity. The most severe include Pattern detected: require('child_process') and Pattern detected: require('child_process').
How was evolver audited?
ClawSecure ran evolver through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 67 files from openclaw/skills.
What does a score of 0 mean?
ClawSecure assigned evolver a security score of 0/100, placing it in the High Risk range. This is driven by 212 findings led by Data Exfiltration that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).
Audit Findings for evolver
ClawSecure detected 212 security findings in evolver, spanning Data Exfiltration, Command Injection, Malicious Code and Policy Violation.
- critical · Pattern detected: require('child_process'). Command Injection finding detected in
index.js:8. - critical · Pattern detected: require('child_process'). Command Injection finding detected in
index.js:30. - critical · Pattern detected: execSync(. Command Injection finding detected in
index.js:33. - critical · Pattern detected: execSync(. Command Injection finding detected in
index.js:34. - critical · Pattern detected: require('child_process'). Command Injection finding detected in
index.js:338. - critical · Pattern detected: execSync(. Command Injection finding detected in
index.js:359. - critical · Pattern detected: execSync(. Command Injection finding detected in
index.js:360. - critical · Pattern detected: execSync(. Command Injection finding detected in
index.js:361. - critical · Pattern detected: execSync(. Command Injection finding detected in
index.js:443. - critical · Pattern detected: execSync(. Command Injection finding detected in
index.js:444. - critical · Pattern detected: require('child_process'). Command Injection finding detected in
scripts/build_public.js:3. - critical · Pattern detected: execSync(. Command Injection finding detected in
scripts/build_public.js:170.
Showing the 12 highest-severity of 212 findings. The full interactive list appears below.
3-Layer Audit Protocol
Security Recommendations for evolver
Audit external network connections
Harden command execution
Resolve policy violations
Related Security Research
ClawHavoc Explained: The Malware Family Targeting AI Agents→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→Related AI Agent Security Audits
Scanned on March 12, 2026. evolver is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.