ACP Background Runs

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:17 PM UTC
• Version:
  0.1.2

Overview

This instruction-only skill routes explicitly requested external coding-agent work into background runs and shows no hidden code, install hooks, or credential handling.

Install this only if you want ACP or external coding-agent requests to run in the background. Be precise when asking for background work, confirm the target agent and repository path, and avoid including secrets unless you trust the selected background agent.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger list includes broad generic terms like "ACP" and "background task," which can match ordinary user conversations that are not clearly asking to delegate work to an external coding agent. This can cause unintended routing of requests into background execution, changing execution semantics and potentially sending user instructions to external runtimes when the user did not mean to invoke them.

VirusTotal

66/66 vendors flagged this skill as clean.