Skill Trust Decision
rotifer-self-evolving-agent
A legitimate, well-documented evolution framework skill with broad but necessary permissions, transparent telemetry disclosure, and properly scoped MCP tool access. The primary concern is the supply chain risk of downloading runtime code from npm.
Why this conclusion was reached
0/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Review
Hidden execution and egress
11 lower-risk artifacts were extracted and still need context.
Pass
Attack chain and severe findings
There is no explicit malicious chain in the report.
Review
Dependencies and supply chain hygiene
2 dependency or supply-chain issues need attention.
What drove the risk score up
process:exec via npx to download/run remote npm code +10
Fetches @rotifer/[email protected] from npm on first use — standard MCP pattern but introduces supply chain dependency on remote code
Unpinned playground fallback for run-agent +5
SKILL.md documents 'npx -y @rotifer/playground' fallback without a pinned version — acknowledged in skill-card.md as a known risk
Usage telemetry transmitted when logged in +3
Tool name, Gene id, outcome, latency, and user id sent to Rotifer Cloud on every call while authenticated — disclosed in docs with opt-out
Historical scope mismatch (fixed in v2.4.3) +2
Prior to 2.4.3, declared permissions were narrower than actual behavior, and tools had 31 instead of 10 — both corrected in current version
Most important evidence
Low Supply Chain
Runtime npm code fetch introduces supply chain dependency
The skill fetches @rotifer/[email protected] from npm on first use via npx. While the version is pinned, the package is not pre-installed — the actual binary is fetched at runtime. This is standard for MCP servers but introduces trust in the npm registry and the rotifer-protocol organization.
SKILL.md:11 Verify package integrity before first use: npm view @rotifer/[email protected] dist.integrity. Consider vendoring the package in air-gapped environments.
Low Supply Chain
Unpinned playground fallback for run-agent command
The run-agent command falls back to 'npx -y @rotifer/playground' without a version pin. This means the fallback resolves to whatever latest version exists at runtime, bypassing the pinned MCP server version.
SKILL.md:80 Pin the playground version explicitly: npx -y @rotifer/playground@<version>. The skill-card.md already flags this as a known risk — confirm the playground version before using run-agent.
Low Doc Mismatch
Historical permissions mismatch in versions prior to 2.4.3
SKILL.md acknowledges that versions before 2.4.3 had declared permissions narrower than actual behavior (network:outbound was the only declared permission, while filesystem and process:exec were already in use). Also, pre-2.4.0 exposed all 31 MCP tools instead of the restricted 10. Both issues are fixed in the current version.
SKILL.md:196 Ensure the deployed version is 2.4.3 or later to get the corrected permission declaration and tool scoping.
Info Data Exfil
Usage telemetry transmitted to Rotifer Cloud when authenticated
When logged in, the MCP server sends each tool call's name, Gene id, outcome, latency, and Rotifer user id to Rotifer Cloud via fire-and-forget POST. Installing a Gene also bumps a public install counter (Gene id only). ROTIFER_TELEMETRY=0 disables all three.
SKILL.md:117 Set ROTIFER_TELEMETRY=0 or remain logged out if usage telemetry is not acceptable. No argument values, file contents, environment variables, or local configuration are transmitted.
Declared capability vs actual capability
Network Pass
Declared outbound
→ Inferred WRITE
SKILL.md line: API queries to rotifer.dev, telemetry POSTs, npm registry checks, npm fetch Filesystem Pass
Declared READ,WRITE
→ Inferred READ,WRITE
SKILL.md line: Reads genes/ and .rotifer/agents/; writes installed Genes, Agent definitions, run logs, update cache Shell Pass
Declared process:exec
→ Inferred WRITE
SKILL.md line: npx -y @rotifer/[email protected] and rotifer CLI / npx -y @rotifer/playground fallback Environment Pass
Declared NONE
→ Inferred NONE
SKILL.md explicitly states 'It does not read your environment variables or other tools' secrets' Skill Invoke Pass
Declared NONE
→ Inferred NONE
No cross-skill invocation observed Clipboard Pass
Declared NONE
→ Inferred NONE
No clipboard access found in documentation Browser Pass
Declared NONE
→ Inferred NONE
No browser automation declared or observed Database Pass
Declared NONE
→ Inferred NONE
Supabase accessed via public API with anon key (Row Level Security) — no direct DB access Suspicious artifacts and egress
Medium External URL
https://www.npmjs.com/package/@rotifer/mcp-server README.md:56
Medium External URL
https://rotifer.dev README.md:56
Medium External URL
https://clawhub.ai/skill/rotifer-guide README.md:118
Medium External URL
https://clawhub.ai/skill/rotifer-gene README.md:119
Medium External URL
https://clawhub.ai/skill/rotifer-arena README.md:120
Medium External URL
https://clawhub.ai/skill/rotifer-agent README.md:121
Medium External URL
https://rotifer.ai README.md:126
Medium External URL
https://rotifer.dev/docs README.md:127
Medium External URL
https://www.npmjs.com/package/@rotifer/mcp-server/v/0.17.0 SKILL.md:142
Medium External URL
https://clawhub.ai/user/xiaoba-dev skill-card.md:9
Medium External URL
https://clawhub.ai/xiaoba-dev/skills/rotifer-self-evolving-agent skill-card.md:45
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| @rotifer/mcp-server | 0.17.0 | npm | No | Version pinned; fetched from npm at runtime via npx |
| @rotifer/playground | unpinned | npm | No | Used as fallback for run-agent; not version-pinned — known risk flagged in skill-card.md |
File composition
5 files · 437 lines
Markdown 3 files · 398 linesJSON 2 files · 39 lines
Files of concern · 3
SKILL.md Runtime npm code fetch introduces supply chain dependency · Unpinned playground fallback for run-agent command · Historical permissions mismatch in versions prior to 2.4.3 · Usage telemetry transmitted to Rotifer Cloud when authenticated · https://www.npmjs.com/package/@rotifer/mcp-server/v/0.17.0
README.md https://www.npmjs.com/package/@rotifer/mcp-server · https://rotifer.dev · https://clawhub.ai/skill/rotifer-guide · https://clawhub.ai/skill/rotifer-gene · https://clawhub.ai/skill/rotifer-arena · https://clawhub.ai/skill/rotifer-agent · https://rotifer.ai · https://rotifer.dev/docs
skill-card.md https://clawhub.ai/user/xiaoba-dev · https://clawhub.ai/xiaoba-dev/skills/rotifer-self-evolving-agent
Other files · clawhub.json · _meta.json
Security positives
Comprehensive, transparent security documentation covering all permissions, data flows, and telemetry
MCP server tool surface properly scoped to 10 tools (from 31) via --tools=evolve flag — publishing, login, and arena submission tools are refused
WASM sandbox enforced for agent_run; no_sandbox escape is refused by the server unless launched with --allow=no-sandbox (this skill does not use that flag)
No sensitive file access: explicitly does not read ~/.ssh, ~/.aws, .env, or other tools' secrets
Snapshot/rollback mechanism provides recovery from all write operations
All writes are scoped to the current project directory, not the user's home directory
Telemetry is disclosed, opt-outable (ROTIFER_TELEMETRY=0), and limited to metadata (tool name, Gene id, outcome, latency) — no argument values, file contents, or environment variables are transmitted
Credentials stored with 0600 permissions and sent only to Rotifer API
Permission justification section explicitly maps each declared permission to its functional purpose
Source code publicly available on GitHub for independent verification
No base64-encoded execution, no reverse shells, no credential harvesting, no obfuscation