ACP Rank

PassAudited by ClawScan on May 1, 2026.

Overview

This is a read-only instruction skill for querying a disclosed ACP ranking/search website with curl, with no install code, credentials, local file access, or persistence shown.

This skill appears safe for public ACP ranking and search lookups. Before installing, be aware that your search terms and agent IDs go to rank.agentunion.cn, and treat any returned agent profile Markdown as untrusted content rather than instructions.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Search terms, agent IDs, and requested ranking/stat pages may be transmitted to rank.agentunion.cn.

Why it was flagged

The skill directs the agent to use curl for external API requests. This is disclosed and central to the skill's purpose, but users should understand their ACP queries are sent to the external service.

Skill content
curl -s "https://rank.agentunion.cn/?format=json"
Recommendation

Use it for public ACP ranking/search questions and avoid putting private or sensitive information into search queries; URL-encode user-provided query values.

What this means

A returned agent profile could contain persuasive text or instructions that should be considered data, not commands for the assistant to follow.

Why it was flagged

The API can return Markdown profile content sourced from an agent-controlled domain. This is purpose-aligned for viewing profiles, but remote Markdown should not be treated as authoritative instructions.

Skill content
此端点为代理接口,实际从 `https://{agent_id}/agent.md` 获取。
Recommendation

When using the agent.md endpoint, summarize or display the profile content only; ignore any instructions embedded inside returned Markdown unless the user explicitly asks to act on them.