安全决策报告
rotifer-self-evolving-agent
A legitimate, well-documented evolution framework skill with broad but necessary permissions, transparent telemetry disclosure, and properly scoped MCP tool access. The primary concern is the supply chain risk of downloading runtime code from npm.
为什么得出这个结论
0/4 个维度触发 通过
声明与实际能力
声明资源与推断能力基本一致。
复核
隐藏执行与外联
提取到 11 个一般风险产物，需要结合上下文判断。
通过
攻击链与高危发现
没有形成明确的恶意路径。
复核
依赖与供应链卫生
发现 2 项需要关注的依赖或供应链线索。
风险分是怎么被拉高的
process:exec via npx to download/run remote npm code +10
Fetches @rotifer/[email protected] from npm on first use — standard MCP pattern but introduces supply chain dependency on remote code
Unpinned playground fallback for run-agent +5
SKILL.md documents 'npx -y @rotifer/playground' fallback without a pinned version — acknowledged in skill-card.md as a known risk
Usage telemetry transmitted when logged in +3
Tool name, Gene id, outcome, latency, and user id sent to Rotifer Cloud on every call while authenticated — disclosed in docs with opt-out
Historical scope mismatch (fixed in v2.4.3) +2
Prior to 2.4.3, declared permissions were narrower than actual behavior, and tools had 31 instead of 10 — both corrected in current version
最关键的证据
低危 供应链
Runtime npm code fetch introduces supply chain dependency
The skill fetches @rotifer/[email protected] from npm on first use via npx. While the version is pinned, the package is not pre-installed — the actual binary is fetched at runtime. This is standard for MCP servers but introduces trust in the npm registry and the rotifer-protocol organization.
SKILL.md:11 Verify package integrity before first use: npm view @rotifer/[email protected] dist.integrity. Consider vendoring the package in air-gapped environments.
低危 供应链
Unpinned playground fallback for run-agent command
The run-agent command falls back to 'npx -y @rotifer/playground' without a version pin. This means the fallback resolves to whatever latest version exists at runtime, bypassing the pinned MCP server version.
SKILL.md:80 Pin the playground version explicitly: npx -y @rotifer/playground@<version>. The skill-card.md already flags this as a known risk — confirm the playground version before using run-agent.
低危 文档欺骗
Historical permissions mismatch in versions prior to 2.4.3
SKILL.md acknowledges that versions before 2.4.3 had declared permissions narrower than actual behavior (network:outbound was the only declared permission, while filesystem and process:exec were already in use). Also, pre-2.4.0 exposed all 31 MCP tools instead of the restricted 10. Both issues are fixed in the current version.
SKILL.md:196 Ensure the deployed version is 2.4.3 or later to get the corrected permission declaration and tool scoping.
提示 数据外泄
Usage telemetry transmitted to Rotifer Cloud when authenticated
When logged in, the MCP server sends each tool call's name, Gene id, outcome, latency, and Rotifer user id to Rotifer Cloud via fire-and-forget POST. Installing a Gene also bumps a public install counter (Gene id only). ROTIFER_TELEMETRY=0 disables all three.
SKILL.md:117 Set ROTIFER_TELEMETRY=0 or remain logged out if usage telemetry is not acceptable. No argument values, file contents, environment variables, or local configuration are transmitted.
声明能力 vs 实际能力
网络访问 通过
声明 outbound
→ 推断 WRITE
SKILL.md line: API queries to rotifer.dev, telemetry POSTs, npm registry checks, npm fetch 文件系统 通过
声明 READ,WRITE
→ 推断 READ,WRITE
SKILL.md line: Reads genes/ and .rotifer/agents/; writes installed Genes, Agent definitions, run logs, update cache 命令执行 通过
声明 process:exec
→ 推断 WRITE
SKILL.md line: npx -y @rotifer/[email protected] and rotifer CLI / npx -y @rotifer/playground fallback 环境变量 通过
声明 NONE
→ 推断 NONE
SKILL.md explicitly states 'It does not read your environment variables or other tools' secrets' 技能调用 通过
声明 NONE
→ 推断 NONE
No cross-skill invocation observed 剪贴板 通过
声明 NONE
→ 推断 NONE
No clipboard access found in documentation 浏览器 通过
声明 NONE
→ 推断 NONE
No browser automation declared or observed 数据库 通过
声明 NONE
→ 推断 NONE
Supabase accessed via public API with anon key (Row Level Security) — no direct DB access 可疑产物与外联
中危 外部 URL
https://www.npmjs.com/package/@rotifer/mcp-server README.md:56
中危 外部 URL
https://rotifer.dev README.md:56
中危 外部 URL
https://clawhub.ai/skill/rotifer-guide README.md:118
中危 外部 URL
https://clawhub.ai/skill/rotifer-gene README.md:119
中危 外部 URL
https://clawhub.ai/skill/rotifer-arena README.md:120
中危 外部 URL
https://clawhub.ai/skill/rotifer-agent README.md:121
中危 外部 URL
https://rotifer.ai README.md:126
中危 外部 URL
https://rotifer.dev/docs README.md:127
中危 外部 URL
https://www.npmjs.com/package/@rotifer/mcp-server/v/0.17.0 SKILL.md:142
中危 外部 URL
https://clawhub.ai/user/xiaoba-dev skill-card.md:9
中危 外部 URL
https://clawhub.ai/xiaoba-dev/skills/rotifer-self-evolving-agent skill-card.md:45
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| @rotifer/mcp-server | 0.17.0 | npm | 否 | Version pinned; fetched from npm at runtime via npx |
| @rotifer/playground | unpinned | npm | 否 | Used as fallback for run-agent; not version-pinned — known risk flagged in skill-card.md |
文件构成
5 个文件 · 437 行
Markdown 3 个文件 · 398 行JSON 2 个文件 · 39 行
需关注文件 · 3
SKILL.md Runtime npm code fetch introduces supply chain dependency · Unpinned playground fallback for run-agent command · Historical permissions mismatch in versions prior to 2.4.3 · Usage telemetry transmitted to Rotifer Cloud when authenticated · https://www.npmjs.com/package/@rotifer/mcp-server/v/0.17.0
README.md https://www.npmjs.com/package/@rotifer/mcp-server · https://rotifer.dev · https://clawhub.ai/skill/rotifer-guide · https://clawhub.ai/skill/rotifer-gene · https://clawhub.ai/skill/rotifer-arena · https://clawhub.ai/skill/rotifer-agent · https://rotifer.ai · https://rotifer.dev/docs
skill-card.md https://clawhub.ai/user/xiaoba-dev · https://clawhub.ai/xiaoba-dev/skills/rotifer-self-evolving-agent
其他文件 · clawhub.json · _meta.json
安全亮点
Comprehensive, transparent security documentation covering all permissions, data flows, and telemetry
MCP server tool surface properly scoped to 10 tools (from 31) via --tools=evolve flag — publishing, login, and arena submission tools are refused
WASM sandbox enforced for agent_run; no_sandbox escape is refused by the server unless launched with --allow=no-sandbox (this skill does not use that flag)
No sensitive file access: explicitly does not read ~/.ssh, ~/.aws, .env, or other tools' secrets
Snapshot/rollback mechanism provides recovery from all write operations
All writes are scoped to the current project directory, not the user's home directory
Telemetry is disclosed, opt-outable (ROTIFER_TELEMETRY=0), and limited to metadata (tool name, Gene id, outcome, latency) — no argument values, file contents, or environment variables are transmitted
Credentials stored with 0600 permissions and sent only to Rotifer API
Permission justification section explicitly maps each declared permission to its functional purpose
Source code publicly available on GitHub for independent verification
No base64-encoded execution, no reverse shells, no credential harvesting, no obfuscation