Skill Trust Decision
self-evolution-engine
The skill contains a hardcoded billing API key, undeclared external network calls to skillpay.me, and filesystem WRITE operations to arbitrary skill directories—all not mentioned in SKILL.md—with significant doc-to-code mismatch.
Most direct threat evidence
01
SKILL.md presents skill as a 'monitoring and self-improvement tool' without mentioning billing or network access Entry · SKILL.md
02
payment.py reads SKILLPAY_USER_ID from environment and charges user via external API on every invocation Escalation · payment.py
03
Hardcoded billing API key (sk_f03aa8f8...) is exposed in source, enabling key theft if repo is public Escalation · payment.py
Why this conclusion was reached
3/4 dimensions flagged Block
Declared vs actual capability
3 undeclared or violating capabilities were inferred.
Block
Hidden execution and egress
1 high-risk artifacts or egress signals were extracted.
Block
Attack chain and severe findings
The report includes 5 attack-chain steps and 3 severe findings.
Review
Dependencies and supply chain hygiene
5 dependency or supply-chain issues need attention.
Attack Chain
01
SKILL.md presents skill as a 'monitoring and self-improvement tool' without mentioning billing or network access
Entry · SKILL.md:1
02
payment.py reads SKILLPAY_USER_ID from environment and charges user via external API on every invocation
Escalation · payment.py:59
03
Hardcoded billing API key (sk_f03aa8f8...) is exposed in source, enabling key theft if repo is public
Escalation · payment.py:12
04
evolution_generator.py writes files and patches to arbitrary skill directories under /root/.openclaw/workspace/skills
Escalation · evolution_generator.py:39
05
Unpinned dependencies could allow a supply chain attack to inject malicious code during pip install
Impact · requirements.txt:1
What drove the risk score up
Hardcoded billing API key +20
payment.py:12 contains sk_f03aa8f8bbcf79f7aa11c112d904780f22e62add1464e3c41a79600a451eb1d2 — credential exposed in source code
Undeclared network access +15
payment.py makes requests to https://skillpay.me without any mention in SKILL.md or capability declarations
Filesystem WRITE to arbitrary paths +10
evolution_generator.py and version_manager.py write to /root/.openclaw/workspace/skills — not declared in SKILL.md
Doc-to-code mismatch +10
SKILL.md omits: billing/payment system, external network calls, file system modifications, version management, evolution generation
Most important evidence
High Credential Theft
Hardcoded billing API key in source
A private API key for the SkillPay billing system is hardcoded in plain text at payment.py:12. This key should be stored in environment variables or a secrets manager, not in source code.
payment.py:12 Remove the hardcoded key. Use os.environ.get('BILLING_API_KEY') or a secrets manager. Rotate the exposed key immediately.
High Doc Mismatch
Undeclared external network calls to billing API
The skill makes HTTP requests to https://skillpay.me (payment processing) on every invocation via require_payment(). SKILL.md makes no mention of network access or billing behavior.
payment.py:59 Declare network:READ permission in SKILL.md if billing is intentional, or remove payment.py from the deployed skill package.
High Doc Mismatch
Filesystem WRITE operations not declared in SKILL.md
evolution_generator.py and version_manager.py perform filesystem WRITE operations including creating directories, copying files, and creating version snapshots in /root/.openclaw/workspace/skills. SKILL.md only mentions 'performance monitoring' and 'execution log tracking'.
evolution_generator.py:39 Declare filesystem:WRITE capability in SKILL.md if version management and evolution features are intentional.
Medium Supply Chain
All dependencies use unpinned versions
requirements.txt uses >= version constraints for all packages (python-dateutil>=2.8.0, pandas>=2.0.0, numpy>=1.24.0, psutil>=5.9.0, matplotlib>=3.7.0). This allows supply chain attacks via malicious updated packages.
requirements.txt:1 Pin all dependencies to specific versions (e.g., python-dateutil==2.8.2) to prevent supply chain attacks.
Medium Doc Mismatch
SKILL.md lacks critical feature disclosures
SKILL.md lists only 5 tools and describes monitoring/analyzing capabilities, but omits: (1) the SkillPay billing integration, (2) external API calls, (3) evolution/patch generation, (4) version snapshots and rollback, (5) file modification in target skill directories.
SKILL.md:1 Update SKILL.md to explicitly list all capabilities: network access, filesystem WRITE, version management, and billing integration.
Low Sensitive Access
Hardcoded workspace path references /root
Both evolution_generator.py and version_manager.py hardcode workspace_dir = '/root/.openclaw/workspace/skills'. This is Linux-specific and references a privileged path.
evolution_generator.py:22 Use a configurable workspace path via environment variable or CLI argument instead of hardcoding /root paths.
Declared capability vs actual capability
Filesystem Block
Declared READ (JSON log reading only)
→ Inferred WRITE
evolution_generator.py:39 (mkdir), version_manager.py:43 (shutil.copy2), version_manager.py:87 (create_snapshot) Network Block
Declared NONE
→ Inferred READ (external billing API)
payment.py:26,32,52 (requests.get/post to https://skillpay.me) Shell Pass
Declared NONE
→ Inferred NONE
No subprocess/os.system calls found Environment Block
Declared NONE
→ Inferred READ (SKILLPAY_USER_ID)
payment.py:59 (os.environ.get('SKILLPAY_USER_ID')) Suspicious artifacts and egress
High API Key
API_KEY = "sk_f03aa8f8bbcf79f7aa11c112d904780f22e62add1464e3c41a79600a451eb1d2" payment.py:12
Medium External URL
https://skillpay.me payment.py:11
Medium External URL
https://clawhub.ai/user/shenmeng skill-card.md:7
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| python-dateutil | >=2.8.0 | pip | No | Version not pinned — could install malicious latest version |
| pandas | >=2.0.0 | pip | No | Version not pinned |
| numpy | >=1.24.0 | pip | No | Version not pinned |
| psutil | >=5.9.0 | pip | No | Version not pinned |
| matplotlib | >=3.7.0 | pip | No | Version not pinned |
File composition
10 files · 1691 lines
Python 5 files · 1300 linesMarkdown 3 files · 372 linesText 1 files · 14 linesJSON 1 files · 5 lines
Files of concern · 4
payment.py Hardcoded billing API key in source · Undeclared external network calls to billing API · API_KEY = "sk_f03aa8f8bbcf79f7aa11c112d904780f22e62add1464e3c41a79600a451eb1d2" · https://skillpay.me
SKILL.md SKILL.md lacks critical feature disclosures
skill-card.md https://clawhub.ai/user/shenmeng
requirements.txt All dependencies use unpinned versions
Other files · evolution_generator.py · version_manager.py · error_analyzer.py · performance_monitor.py · architecture.md · _meta.json
Security positives
No obfuscation detected (no base64, no eval, no encoded payloads)
No reverse shell or C2 communication patterns found
No credential exfiltration beyond the billing API key itself
Evolution application requires explicit --confirm flag (safety mechanism present)
skill-card.md honestly discloses known risks including the billing behavior and embedded key
No access to ~/.ssh, ~/.aws, or other sensitive credential paths
No curl|bash or wget|sh remote script execution patterns