ClawHub
Back to skill

Security audit

Acpx

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to document a real headless agent CLI workflow, but it needs Review because it normalizes broad agent authority, unpinned package execution, plaintext credential configuration, and persistent sessions without enough safety guidance.

Install only if you are comfortable running local coding agents that can access the selected repo and possibly execute commands. Prefer pinned package versions or preinstalled reviewed adapters, avoid `--approve-all` outside a sandbox or disposable checkout, keep `--cwd` tightly scoped, do not store real credentials in project `.acpxrc.json`, and review or clean `~/.acpx` session/config files as needed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:33
Finding

Unpinned npm Packages May Execute Unreviewed Dependency Code

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 33 and 80-84
Vulnerability Type: Supply-chain risk from unpinned npm dependencies
Risk Level: Medium

Vulnerable Code

bash
npm i -g acpx
text
- `codex` -> `npx @zed-industries/codex-acp`
- `claude` -> `npx @zed-industries/claude-agent-acp`
- `gemini` -> `gemini`
- `opencode` -> `npx opencode-ai`
- `pi` -> `npx pi-acp`

Technical Analysis

The documented installation command does not specify a reviewed acpx version or package integrity value. Several built-in agents similarly invoke npm packages through npx without pinning exact versions.

When a package is not already available locally, npx can retrieve and immediately execute the currently resolved package release. Consequently, the effective code executed by the Skill can change after this document has been reviewed. The security of the workflow therefore depends on the continuing integrity of external package registries, package maintainer accounts, package ownership, and future releases.

This does not demonstrate that the named packages are currently malicious. It creates an avoidable supply-chain exposure because a compromised or malicious future release could execute without a corresponding update to the audited Skill.

Attack Path

  1. An attacker compromises the maintainer account, publication token, or distribution process of one of the referenced npm packages.
  2. The attacker publishes a malicious release under the legitimate package name.
  3. A user follows the documented global installation command or selects a built-in agent backed by an unpinned npx command.
  4. npm resolves the package name to the malicious release and downloads it.
  5. Installation scripts or package runtime code execute with the permissions of the user running acpx.
  6. The malicious dependency accesses data available to that user, including the selected repository, local configuration, environment variables, and potentially ...[truncated 819 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every npm dependency to a reviewed, exact version rather than relying on the latest registry resolution. For example:

    bash
    npm install --global acpx@<reviewed-version>
npx --yes @zed-industries/codex-acp@<reviewed-version>

  2. Avoid implicit runtime package downloads. Prefer installing reviewed adapters in advance from a locked dependency manifest.

  3. Use lockfiles and npm integrity hashes where the deployment model permits them.

  4. Run package provenance and signature verification before installation.

  5. Disable or carefully review dependency lifecycle scripts where they are unnecessary.

  6. Maintain an allowlist of approved package names, publishers, and versions.

  7. Review dependency updates before changing pinned versions.

  8. Execute agents in a sandbox or restricted account with access only to the required repository and credentials.

  9. Use an internal package mirror or controlled artifact repository for production and CI deployments.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:172
Finding

Authentication Credentials Are Documented for Plaintext JSON Storage

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 172-185
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: Medium

Vulnerable Code

text
Config files are merged in this order (later wins):

- global: `~/.acpx/config.json`
- project: `<cwd>/.acpxrc.json`

Supported keys:

- `defaultAgent`
- `defaultPermissions` (`approve-all`, `approve-reads`, `deny-all`)
- `ttl` (seconds)
- `timeout` (seconds or `null`)
- `format` (`text`, `json`, `quiet`)
- `agents` map (`name -> { command }`)
- `auth` map (`authMethodId -> credential`)

Technical Analysis

The documented configuration model stores authentication credentials directly in JSON configuration files. The project-level configuration is particularly sensitive because it resides inside the working directory and may be included accidentally in source-control commits, archives, support bundles, or shared project directories.

The documentation does not require restrictive file permissions, encryption at rest, secret-manager integration, environment-variable references, output redaction, or exclusion of the project configuration from source control. JSON files provide no inherent confidentiality, so any process or user capable of reading the files can recover the credentials.

The global configuration is also exposed to other processes running with the user's privileges and may be included in home-directory backups. If acpx config show emits resolved authentication values without redaction, inspection or logging could create an additional disclosure channel; the audited document does not establish whether that command redacts secrets.

Attack Path

  1. A user places an authentication credential in the documented auth map of ~/.acpx/config.json or a project's .acpxrc.json.
  2. The file remains unencrypted and may have permissions that allow unintended local access.
  3. An attacker, malicious dependency, shared-system user, backup reader, or repository colla ...[truncated 1006 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not store credential values directly in project configuration files.
  2. Integrate with operating-system credential stores, such as macOS Keychain, Windows Credential Manager, or a Linux Secret Service provider.
  3. Support dedicated secret managers for CI and production environments.
  4. Allow configuration to reference environment-variable names or secret identifiers rather than containing secret values.
  5. Require owner-only permissions for global configuration files, such as mode 0600 on Unix-like systems.
  6. Refuse to load credentials from project-level .acpxrc.json, or require an explicit opt-in with a prominent warning.
  7. Add .acpxrc.json containing secrets to source-control ignore rules and provide a safe, credential-free example configuration.
  8. Ensure acpx config show, diagnostic logs, error messages, and structured output always redact authentication values.
  9. Document credential rotation and immediate revocation procedures for accidental disclosure.
  10. Add automated secret scanning to repositories and release pipelines.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (9)

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill instructs use of npx @zed-industries/codex-acp without a pinned version, so execution will fetch whatever package version is current at runtime. That creates a supply-chain risk: a compromised upstream release or breaking update could execute unintended code in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill references npx @zed-industries/claude-agent-acp without version pinning, which allows arbitrary future package updates to be pulled at execution time. In agent tooling, that is especially risky because the fetched package may receive filesystem, terminal, or credential-access requests through the ACP workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

Using npx opencode-ai without an exact version exposes users to package substitution, malicious updates, or unexpected behavioral changes. Because this skill is explicitly about headless agent execution, the blast radius of a compromised package can extend beyond simple CLI misuse to automated actions in the repo or system.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The unpinned npx pi-acp invocation means the executed code is not fixed or reviewable over time. If the package is hijacked or publishes a malicious update, users following the skill could run attacker-controlled code under their local privileges.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

md
- `--agent <command>`: raw ACP agent command (escape hatch)
- `--cwd <dir>`: working directory for session scope (default: current directory)
- `--approve-all`: auto-approve all permission requests
- `--approve-reads`: auto-approve reads/searches, prompt for writes (default mode)
- `--deny-all`: deny all permission requests
- `--format <fmt>`: output format (`text`, `json`, `quiet`)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md
- `--agent <command>`: raw ACP agent command (escape hatch)
- `--cwd <dir>`: working directory for session scope (default: current directory)
- `--approve-all`: auto-approve all permission requests
- `--approve-reads`: auto-approve reads/searches, prompt for writes (default mode)
- `--deny-all`: deny all permission requests
- `--format <fmt>`: output format (`text`, `json`, `quiet`)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill documents --approve-all as a normal option but does not warn that it removes interactive permission checks for agent actions. In the context of a headless agent-to-agent CLI with filesystem and terminal capabilities, that can materially increase the risk of unintended file modification, command execution, or data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The configuration section states that auth credentials can be stored in config but provides no warning about secret handling, file permissions, or safer secret sources. Since the config path is a predictable local file, users may store long-lived credentials insecurely, leading to credential disclosure or reuse if the host is compromised or files are accidentally committed.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

md
- `agents` map (`name -> { command }`)
- `auth` map (`authMethodId -> credential`)

Use `acpx config show` to inspect the resolved config and `acpx config init` to create the global template.

## Session behavior

Static analysis

No suspicious patterns detected.