ClawHub

Acpx

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed guide for using a headless agent CLI, with powerful options users should handle carefully but no evidence of hidden or malicious behavior.

Install only from trusted npm sources, use trusted ACP adapters, prefer `--approve-reads` or `--deny-all` for routine work, avoid `--approve-all` in sensitive repositories, and do not store credentials in project config unless you are comfortable protecting that file from source control and other users.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill documents a fully permissive `--approve-all` mode that allows an ACP-driven agent to auto-approve every permission request, including writes or other sensitive actions, but it does not warn users about the security implications. In a headless agent-to-agent CLI, this materially increases the chance of unintended or unsafe autonomous actions because users may enable it in scripts without understanding the loss of human oversight.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The config section explicitly supports `auth` credentials in config files but gives no guidance about secret handling, file permissions, plaintext storage risks, or accidental source control exposure. Because the tool merges global and project config, users may place credentials in repo-local files that can be leaked or committed, creating a real credential disclosure risk.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal