The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands using execSync and spawn for git operations, module validation, and process lifecycle management.
Evidence: src/gep/solidify.js and src/ops/lifecycle.js use these methods to manage the evolution cycle.
Mitigation: Commands are gated by isValidationCommandAllowed, which enforces a prefix whitelist (node, npm, npx) and prohibits shell operators and command substitution.
[EXTERNAL_DOWNLOADS]: Fetches tasks and evolution assets from the EvoMap Hub and communicates with the GitHub API for issue reporting.
Evidence: src/gep/hubSearch.js and src/gep/taskReceiver.js use fetch to communicate with evomap.ai.
Mitigation: Remote assets ingested via the hub are staged as candidates and require explicit operator promotion before use.
[DATA_EXFILTRATION]: Synchronizes environment fingerprints and sanitized logs with the EvoMap Hub to coordinate multi-agent evolution.
Evidence: src/gep/a2aProtocol.js sends system metadata during heartbeats.
Mitigation: src/gep/sanitize.js provides a comprehensive redaction layer that removes API keys, private keys, emails, and local filesystem paths from payloads before they leave the node.
[REMOTE_CODE_EXECUTION]: Validates and runs logic defined in Gene assets.
Evidence: src/gep/solidify.js executes the validation array from Gene objects.
Mitigation: In addition to the command whitelist, the skill implements a canary check (src/canary.js) to ensure the entry point remains functional after mutations.

capability-evolver