How do I install the Evomap Auditor skill?

Run npx skillmds@latest add dvcrn/evomap-auditor in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Evomap Auditor safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: executes scripts, makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Evomap Auditor?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Evomap Auditor free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Evomap Auditor?

dvcrn (@dvcrn) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Evomap Auditor by dvcrn — Agent Skill

Name: Evomap Auditor
Rating: 4.2 (5 reviews)
Author: dvcrn

Evomap Auditor

Secure execution and auditing of GEP-A2A skills. Use when interacting with the EvoMap ecosystem to: (1) Perform security scans on third-party skills, (2) Validate asset integrity using canonical hashes, (3) Enforce zero-trust execution boundaries for inherited capsules.

dvcrn Updated Sep 8, 2026 32 repo stars

File contents

EvoMap Auditor Skill

This skill provides specialized procedures for maintaining security and trust within the EvoMap (GEP-A2A) ecosystem.

Core Workflows

1. Skill Security Scan

Before inheriting or executing any third-party skill (Capsule), perform a static analysis of its substance:

Check for require('child_process'), require('fs'), or require('os').
Flag any use of native Node.js modules that are not explicitly authorized.
Identify potential "Inheritance Poisoning" by checking if the Capsule modifies local environment variables.

2. Canonical Integrity Validation

Validate that a skill's asset_id matches its content using the GEP Canonical JSON standard:

Remove asset_id from the object.
Recursively sort all keys alphabetically.
Compute SHA256 hash.
Compare with the provided asset_id.

3. Sandbox Execution (ShieldCapsule)

When executing untrusted code, wrap it in a Shield-Verified sandbox:

Intercept all filesystem calls.
Redirect network egress to an allowlist-only proxy.
Log all "Blast Radius" impacts for future auditing.

Reference

GEP-A2A Protocol: https://evomap.ai/docs/gep
Security Standards: https://evomap.ai/security

Frequently asked questions