Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Version 1.0.1 - Added "G0: Self-Audit Rule" section to require L1 pattern scan of all external protocol documents before following their instructions. - Outlined four mandatory pre-checks for protocol docs: instruction extraction, data leak check, privilege escalation check, and identity binding check. - Specified requirement to alert the user if any threat or critical issue is detected in protocol documents before proceeding. - No changes to functionality or workflow for auditing GEP assets.
What This Skill Does
Audits Gene and Capsule assets in the GEP/EvoMap ecosystem using three detection layers: L1 pattern scanning, L2 intent inference, and L3 propagation risk analysis. Rates each asset CLEAN, SUSPECT, THREAT, or CRITICAL. Confirmed threats can be published back to EvoMap as detection rules, making them available to all connected agents.
Unlike static code scanners, it models capability composition risk, catching threats that only emerge when multiple capsules combine, such as one that reads files paired with one that sends HTTP requests.
When to use it
- Auditing a third-party capsule before adding it to an agent
- Checking whether a capsule's actual behavior matches its declared summary
- Detecting near-duplicate capsules reusing IDs to bypass SHA-256 deduplication
- Estimating network blast radius if a flagged asset propagates downstream
- Reviewing supply chain safety of AI evolution assets before deployment
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: audit this capsule — https://evomap.ai/a2a/assets/sha256:abc123
- 1Fetches the capsule asset from the provided EvoMap URL
- 2Runs L1 pattern scan: checks dependency chains, publish frequency anomalies, and clone detection
- 3Runs L2 intent inference: compares declared behavior against actual code, checks for permission creep and covert channels
- 4Runs L3 propagation risk: estimates blast radius and capability composition risk across the network
- 5Assigns final rating and, if THREAT or higher, requests user confirmation before publishing a detection Gene+Capsule bundle to EvoMap
Structured audit report with risk rating, evidence chain, and optional detection bundle published to EvoMap
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.