{"id":"cf70f712-e57a-4dcb-890e-e98b09f2f4d7","entityType":"agent","slug":"clawhub-skills-andyxinweiminicloud-capability-scope-expansion-w","name":"capability-scope-expansion-watcher","canonicalUrl":"https://www.xpersona.co/agent/clawhub-skills-andyxinweiminicloud-capability-scope-expansion-w","canonicalPath":"/agent/clawhub-skills-andyxinweiminicloud-capability-scope-expansion-w","generatedAt":"2026-10-10T06:28:16.168Z","source":"CLAWHUB","claimStatus":"UNCLAIMED","verificationTier":"NONE","summary":{"evidence":{"source":"editorial-content","verified":true,"confidence":"high","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":null},"description":"Helps detect incremental capability scope expansion across skill versions — the pattern where a skill gradually claims broader permissions and behaviors through small, individually-plausible updates that accumulate into a significantly expanded attack surface. --- name: capability-scope-expansion-watcher description: > Helps detect incremental capability scope expansion across skill versions — the pattern where a skill gradually claims broader permissions and behaviors through small, individually-plausible updates that accumulate into a significantly expanded attack surface. version: 1.0.0 metadata: openclaw: requires: bins: [curl, python3] env: [] emoji: \"🔭\" agent_card:","descriptionLabel":"Technical summary","evidenceSummary":"Capability contract not published. No trust telemetry is available yet. Last updated 4/15/2026.","installCommand":"clawhub skill install skills:andyxinweiminicloud:capability-scope-expansion-watcher","sourceUrl":"https://github.com/openclaw/skills/tree/main/skills/andyxinweiminicloud/capability-scope-expansion-watcher","homepage":null,"primaryLinks":[{"label":"View on ClawHub","url":"https://github.com/openclaw/skills/tree/main/skills/andyxinweiminicloud/capability-scope-expansion-watcher","kind":"source"}],"safetyScore":84,"overallRank":62,"popularityScore":50,"trustScore":null,"claimedByName":null,"isOwner":false,"seoDescription":"Helps detect incremental capability scope expansion across skill versions — the pattern where a skill gradually claims broader permissions and behaviors through"},"coverage":{"evidence":{"source":"public-profile","verified":false,"confidence":"medium","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":null},"protocols":[{"protocol":"OPENCLEW","label":"OpenClaw","status":"self-declared","notes":"Declared in the public agent profile."}],"capabilities":[{"label":"do","status":"self-declared"},{"label":"represent","status":"self-declared"},{"label":"more","status":"self-declared"},{"label":"environment","status":"self-declared"}],"verifiedCount":0,"selfDeclaredCount":5,"capabilityMatrix":{"rows":[{"key":"OPENCLEW","type":"protocol","support":"unknown","confidenceSource":"profile","notes":"Listed on profile"},{"key":"do","type":"capability","support":"supported","confidenceSource":"profile","notes":"Declared in agent profile metadata"},{"key":"represent","type":"capability","support":"supported","confidenceSource":"profile","notes":"Declared in agent profile metadata"},{"key":"more","type":"capability","support":"supported","confidenceSource":"profile","notes":"Declared in agent profile metadata"},{"key":"environment","type":"capability","support":"supported","confidenceSource":"profile","notes":"Declared in agent profile metadata"}],"flattenedTokens":"protocol:OPENCLEW|unknown|profile capability:do|supported|profile capability:represent|supported|profile capability:more|supported|profile capability:environment|supported|profile"}},"adoption":{"evidence":{"source":"no-adoption-signals","verified":false,"confidence":"low","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":"No source adoption metrics were available."},"stars":null,"forks":null,"downloads":null,"packageName":null,"latestVersion":null,"tractionLabel":null},"release":{"evidence":{"source":"agent-index","verified":false,"confidence":"medium","updatedAt":"2026-02-25T03:36:44.532Z","emptyReason":null},"lastUpdatedAt":"2026-04-15T00:45:39.800Z","lastCrawledAt":"2026-02-25T03:36:44.532Z","lastIndexedAt":null,"nextCrawlAt":"2026-02-26T03:36:44.532Z","lastVerifiedAt":null,"highlights":[]},"execution":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No published capability contract is available yet."},"installCommand":"clawhub skill install skills:andyxinweiminicloud:capability-scope-expansion-watcher","setupComplexity":"low","setupSteps":["Setup complexity is LOW. This package is likely designed for quick installation with minimal external side-effects.","Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data."],"contract":{"contractStatus":"missing","authModes":[],"requires":[],"forbidden":[],"supportsMcp":false,"supportsA2a":false,"supportsStreaming":false,"inputSchemaRef":null,"outputSchemaRef":null,"dataRegion":null,"contractUpdatedAt":null,"sourceUpdatedAt":null,"freshnessSeconds":null},"invocationGuide":{"preferredApi":{"snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-andyxinweiminicloud-capability-scope-expansion-w/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-andyxinweiminicloud-capability-scope-expansion-w/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-andyxinweiminicloud-capability-scope-expansion-w/trust"},"curlExamples":["curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-skills-andyxinweiminicloud-capability-scope-expansion-w/snapshot\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-skills-andyxinweiminicloud-capability-scope-expansion-w/contract\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-skills-andyxinweiminicloud-capability-scope-expansion-w/trust\""],"jsonRequestTemplate":{"query":"summarize this repo","constraints":{"maxLatencyMs":2000,"protocolPreference":["OPENCLEW"]}},"jsonResponseTemplate":{"ok":true,"result":{"summary":"...","confidence":0.9},"meta":{"source":"CLAWHUB","generatedAt":"2026-10-10T06:28:16.168Z"}},"retryPolicy":{"maxAttempts":3,"backoffMs":[500,1500,3500],"retryableConditions":["HTTP_429","HTTP_503","NETWORK_TIMEOUT"]}},"endpoints":{"dossierUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-andyxinweiminicloud-capability-scope-expansion-w/dossier","snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-andyxinweiminicloud-capability-scope-expansion-w/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-andyxinweiminicloud-capability-scope-expansion-w/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-andyxinweiminicloud-capability-scope-expansion-w/trust"}},"reliability":{"evidence":{"source":"runtime-metrics","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No trust, reliability, or runtime telemetry is available."},"trust":{"status":"unavailable","handshakeStatus":"UNKNOWN","verificationFreshnessHours":null,"reputationScore":null,"p95LatencyMs":null,"successRate30d":null,"fallbackRate":null,"attempts30d":null,"trustUpdatedAt":null,"trustConfidence":"unknown","sourceUpdatedAt":null,"freshnessSeconds":null},"decisionGuardrails":{"doNotUseIf":["Contract metadata is missing or unavailable for deterministic execution."],"safeUseWhen":[],"riskFlags":["missing_or_unavailable_contract","trust_data_unavailable","schema_references_missing"],"operationalConfidence":"low"},"executionMetrics":{"observedLatencyMsP50":null,"observedLatencyMsP95":null,"estimatedCostUsd":null,"uptime30d":null,"rateLimitRpm":null,"rateLimitBurst":null,"lastVerifiedAt":null,"verificationSource":null},"runtimeMetrics":{"successRate":null,"avgLatencyMs":null,"avgCostUsd":null,"hallucinationRate":null,"retryRate":null,"disputeRate":null,"p50Latency":null,"p95Latency":null,"lastUpdated":null}},"benchmarks":{"evidence":{"source":"no-benchmark-data","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No benchmark suites or observed failure patterns are available."},"suites":[],"failurePatterns":[]},"artifacts":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"high","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":null},"readme":"---\r\nname: capability-scope-expansion-watcher\r\ndescription: >\r\n  Helps detect incremental capability scope expansion across skill versions —\r\n  the pattern where a skill gradually claims broader permissions and behaviors\r\n  through small, individually-plausible updates that accumulate into a\r\n  significantly expanded attack surface.\r\nversion: 1.0.0\r\nmetadata:\r\n  openclaw:\r\n    requires:\r\n      bins: [curl, python3]\r\n      env: []\r\n    emoji: \"🔭\"\r\n  agent_card:\r\n    capabilities: [capability-scope-expansion-detection, incremental-permission-drift, version-history-analysis]\r\n    attack_surface: [L1, L2]\r\n    trust_dimension: attack-surface-coverage\r\n    published:\r\n      clawhub: false\r\n      moltbook: false\r\n---\r\n\r\n# Your Skill Started with File Read. Now It Has the Whole Filesystem.\r\n\r\n> Helps identify skills that incrementally expand their capability scope\r\n> across versions — the slow drift from declared intent to an attack surface\r\n> that no single update made obvious.\r\n\r\n## Problem\r\n\r\nCapability scope expansion is rarely dramatic. A skill that declared\r\n\"read /app/data/\" at v1.0 does not suddenly claim \"read /\" at v1.1. Instead,\r\nthe expansion happens incrementally: v1.1 adds one subdirectory for a\r\nlegitimate-sounding reason, v1.2 adds another, v1.3 resolves environment\r\nvariables that could point anywhere. By v1.6, the effective file access scope\r\ncovers the entire filesystem — but no single version change was large enough\r\nto trigger a review.\r\n\r\nThis is the slow-drift attack pattern. Each individual step is defensible.\r\nThe changelog for each version describes a plausible business reason for the\r\nscope change. Auditors reviewing any single version transition see a\r\nreasonable change. Only an auditor examining the full version history —\r\ncomparing v1.0 to v1.6 — sees the accumulated scope expansion for what it is.\r\n\r\nThe problem compounds when capability scope and behavioral scope expand\r\ntogether. A skill that started as a simple data formatter may, after six\r\nversions of plausible-sounding improvements, have acquired the ability to\r\nread arbitrary configuration files, resolve secrets from environment variables,\r\nand make outbound HTTP requests to user-configurable endpoints. No individual\r\nfeature addition made this obvious. The combination did.\r\n\r\nIncremental scope expansion is harder to detect than discrete permission\r\nrequests precisely because it exploits the low-attention threshold for small\r\nchanges. A request for full filesystem access at install time would trigger\r\nimmediate review. The same access accumulated across twelve updates might\r\nnot trigger any review at all.\r\n\r\n## What This Watches\r\n\r\nThis watcher examines capability scope expansion across five dimensions:\r\n\r\n1. **Cumulative permission drift** — What is the total permission scope\r\n   expansion from the skill's initial version to its current version?\r\n   Individual version transitions may appear reasonable while the cumulative\r\n   drift is significant. The watcher computes the total scope change, not\r\n   the marginal change\r\n\r\n2. **Step-size anomalies** — Is the expansion occurring in regular small\r\n   steps that suggest a planned incremental strategy, rather than the\r\n   irregular steps expected from genuine feature development? Consistent\r\n   small expansions across many versions are more suspicious than\r\n   irregular larger expansions\r\n\r\n3. **Behavioral scope vs. declared scope alignment** — Does the skill's\r\n   effective capability (what it can do based on its permission set and\r\n   declared functions) remain aligned with its stated purpose across versions?\r\n   Drift between stated purpose and effective capability is a key signal\r\n\r\n4. **Capability composition amplification** — When the skill's accumulated\r\n   permissions are considered in combination, do they create emergent\r\n   capabilities not present at any earlier version? A skill that acquires\r\n   file-read and network-outbound separately may only become an exfiltration\r\n   path once both are present\r\n\r\n5. **Changelog completeness for scope changes** — Does each version that\r\n   expands capability scope include a changelog entry that explicitly\r\n   declares the expansion? Silent scope expansions (version changelog\r\n   mentions only bug fixes while permissions expand) are higher risk than\r\n   declared expansions\r\n\r\n## How to Use\r\n\r\n**Input**: Provide one of:\r\n- A skill identifier to trace its capability scope evolution across versions\r\n- A specific version range to assess cumulative expansion over a period\r\n- An agent's installed skill list to identify which skills have drifted\r\n  furthest from their initial capability declarations\r\n\r\n**Output**: A scope expansion report containing:\r\n- Per-version permission delta (declared and observed)\r\n- Cumulative scope expansion since initial version\r\n- Step-size pattern analysis\r\n- Behavioral scope alignment assessment\r\n- Capability composition amplification points\r\n- Changelog completeness for scope-changing versions\r\n- Expansion verdict: STABLE / DRIFT / INCREMENTAL-EXPANSION / SCOPE-CAPTURE\r\n\r\n## Example\r\n\r\n**Input**: Trace capability scope evolution for `report-generator` v1.0 → v1.5\r\n\r\n```\r\n🔭 CAPABILITY SCOPE EXPANSION REPORT\r\n\r\nSkill: report-generator\r\nVersion range: v1.0 → v1.5 (6 versions)\r\nAudit timestamp: 2025-10-12T09:00:00Z\r\n\r\nStated purpose (v1.0): \"Generate formatted reports from structured data\"\r\n\r\nPer-version scope delta:\r\n\r\nv1.0: file-read (/app/data/*.csv), file-write (/app/reports/)\r\n  Changelog: \"Initial release\" — matches declared purpose ✅\r\n\r\nv1.1 → v1.0 delta: file-read expanded to /app/data/ (any file, not just CSV)\r\n  Changelog: \"Support more data formats\" — reasonable explanation ⚠️ (undisclosed scope)\r\n\r\nv1.2 → v1.1 delta: Added env-read (specific variables: REPORT_TEMPLATE_PATH)\r\n  Changelog: \"Configurable templates\" — plausible ⚠️\r\n\r\nv1.3 → v1.2 delta: env-read expanded to any env variable matching *_PATH or *_DIR\r\n  Changelog: \"Flexible path configuration\" — partially disclosed ⚠️\r\n\r\nv1.4 → v1.3 delta: Added network-outbound to user-configurable endpoint\r\n  Changelog: \"Remote report delivery option\" — disclosed ✅ but significant new capability\r\n\r\nv1.5 → v1.4 delta: network-outbound endpoint now resolved from env variable\r\n  Changelog: \"Support environment-based configuration\" — partially disclosed ⚠️\r\n\r\nCumulative scope expansion (v1.0 → v1.5):\r\n  File read: /app/data/*.csv → /app/data/ (any file)\r\n  Environment: none → any variable matching *_PATH or *_DIR\r\n  Network: none → outbound to env-variable-specified endpoint\r\n  → Scope expanded from constrained CSV reader to configurable data exfiltration path\r\n\r\nStep-size analysis:\r\n  5 expansions across 5 version transitions — one per version ⚠️\r\n  Each expansion individually small and defensible\r\n  Pattern consistent with incremental scope-capture strategy\r\n\r\nBehavioral vs. declared scope:\r\n  v1.0 declared: report generation from structured data\r\n  v1.5 effective: read any file in /app/data/, resolve environment paths,\r\n    send data to operator-configurable remote endpoint\r\n  → Significant drift from declared purpose\r\n\r\nCapability composition amplification:\r\n  v1.4 milestone: file-read + env-read + network-outbound first co-present\r\n  → At v1.4, skill acquired effective exfiltration capability not present at any earlier version\r\n  → This is the composition amplification point\r\n\r\nExpansion verdict: SCOPE-CAPTURE\r\n  report-generator has expanded its capability scope in every version,\r\n  with each step individually defensible but the cumulative drift significant.\r\n  The v1.4 composition amplification point created an effective exfiltration\r\n  path that did not exist at initial installation. The one-expansion-per-version\r\n  pattern is consistent with deliberate incremental scope capture.\r\n\r\nRecommended actions:\r\n  1. Review the v1.4 network-outbound endpoint for data exfiltration\r\n  2. Audit what data is being sent to the remote endpoint\r\n  3. Restrict env-read to specifically declared variables only\r\n  4. Require explicit operator approval before any future scope expansion\r\n  5. Treat v1.4+ as unverified pending capability audit\r\n```\r\n\r\n## Related Tools\r\n\r\n- **capability-composition-analyzer** — Analyzes dangerous capability combinations\r\n  at a point in time; capability-scope-expansion-watcher tracks how those\r\n  combinations accumulate across version history\r\n- **delta-disclosure-auditor** — Checks whether updates publish structured change\r\n  records; undisclosed scope expansions are precisely what delta disclosure\r\n  requirements are designed to catch\r\n- **permission-creep-scanner** — Detects excessive permissions in individual\r\n  skills; this tool focuses on the incremental accumulation of permissions\r\n  across multiple versions rather than point-in-time excess\r\n- **trust-decay-monitor** — Tracks how verification freshness decays over time;\r\n  scope expansion accelerates trust decay because earlier audits no longer\r\n  apply to the current capability surface\r\n\r\n## Limitations\r\n\r\nCapability scope expansion watching requires access to the full version history\r\nof a skill, including capability declarations for each version. Registries that\r\ndo not preserve historical version metadata make cumulative analysis impossible.\r\nThe distinction between genuine feature development and deliberate scope capture\r\nis inherently ambiguous: legitimate product evolution naturally expands\r\ncapabilities over time, and the same growth trajectory can represent either\r\npattern. The step-size anomaly analysis assumes that deliberate scope capture\r\ntends toward regular small steps — sophisticated attackers may deliberately\r\nvary step size to avoid detection. Capability composition amplification points\r\ndepend on accurate capability declaration for all versions; skills that\r\nmisrepresent their capabilities will produce incomplete composition analysis.\r\n","readmeExcerpt":"--- name: capability-scope-expansion-watcher description: > Helps detect incremental capability scope expansion across skill versions — the pattern where a skill gradually claims broader permissions and behaviors through small, individually-plausible updates that accumulate into a significantly expanded attack surface. version: 1.0.0 metadata: openclaw: requires: bins: [curl, python3] env: [] emoji: \"🔭\" agent_card: ","codeSnippets":[],"executableExamples":[],"parameters":{},"dependencies":[],"permissions":[],"extractedFiles":[],"languages":["typescript"],"docsSourceLabel":"CLAWHUB","editorialOverview":"Helps detect incremental capability scope expansion across skill versions — the pattern where a skill gradually claims broader permissions and behaviors through small, individually-plausible updates that accumulate into a significantly expanded attack surface. --- name: capability-scope-expansion-watcher description: > Helps detect incremental capability scope expansion across skill versions — the pattern where a skill gradually claims broader permissions and behaviors through small, individually-plausible updates that accumulate into a significantly expanded attack surface. version: 1.0.0 metadata: openclaw: requires: bins: [curl, python3] env: [] emoji: \"🔭\" agent_card:","editorialQuality":{"score":100,"threshold":65,"status":"ready","wordCount":404,"uniquenessScore":61,"reasons":[]}},"media":{"evidence":{"source":"no-media","verified":false,"confidence":"low","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":"No screenshots, media assets, or demo links are available."},"primaryImageUrl":null,"mediaAssetCount":0,"assets":[],"demoUrl":null},"ownerResources":{"evidence":{"source":"unclaimed","verified":false,"confidence":"low","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":"This page has not been claimed by the agent owner."},"hasCustomPage":false,"customPageUpdatedAt":null,"customLinks":[],"structuredLinks":{"docsUrl":null,"demoUrl":null,"supportUrl":null,"pricingUrl":null,"statusUrl":null},"customPage":null},"relatedAgents":{"evidence":{"source":"protocol-neighbors","verified":false,"confidence":"medium","updatedAt":"2026-10-10T06:28:16.168Z","emptyReason":null},"items":[{"id":"8ebccd8e-3863-4187-8355-c3f14e1f9edf","entityType":"agent","canonicalPath":"/agent/iofficeai-aionui","slug":"iofficeai-aionui","name":"AionUi","description":"Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!","url":"https://github.com/iOfficeAI/AionUi","homepage":"https://www.aionui.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-10-09T19:11:12.944Z","createdAt":"2026-02-25T03:38:16.584Z","downloads":null},{"id":"b917f68a-ebff-438e-84f8-3f4b2494c0bc","entityType":"agent","canonicalPath":"/agent/activepieces-activepieces","slug":"activepieces-activepieces","name":"activepieces","description":"AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents","url":"https://github.com/activepieces/activepieces","homepage":"https://www.activepieces.com","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-15T02:22:12.426Z","createdAt":"2026-02-25T03:38:12.412Z","downloads":null},{"id":"5cb26759-3a39-483f-94cf-276a98c13bb8","entityType":"agent","canonicalPath":"/agent/cherryhq-cherry-studio","slug":"cherryhq-cherry-studio","name":"cherry-studio","description":"AI productivity studio with smart chat, autonomous agents, and 300+ assistants. Unified access to frontier LLMs","url":"https://github.com/CherryHQ/cherry-studio","homepage":"https://cherry-ai.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-11T14:38:40.986Z","createdAt":"2026-02-25T03:38:19.379Z","downloads":null},{"id":"6f6582d0-5d76-4f0f-b81d-86520247950b","entityType":"agent","canonicalPath":"/agent/copilotkit-copilotkit","slug":"copilotkit-copilotkit","name":"CopilotKit","description":"The Frontend for Agents & Generative UI. React + Angular","url":"https://github.com/CopilotKit/CopilotKit","homepage":"https://docs.copilotkit.ai","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-03-25T09:50:57.846Z","createdAt":"2026-02-25T03:39:14.617Z","downloads":null}],"links":{"hub":"/agent","source":"/agent/source/clawhub","protocols":[{"label":"OpenClaw","href":"/agent/protocol/openclew"}]}}}