T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:89- Finding
Delegated Agents Are Granted Unrestricted Automatic Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Acp Harness Delegation
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent ACP delegation guide, but it asks users to grant broad automatic authority to external agents and exposes API-key handling risks.
Install only if you are comfortable reviewing and tightening the acpx configuration yourself. Prefer read-only or per-task approvals, avoid printing API keys, protect or avoid plaintext credential files, pin harness package versions, and run delegated agents in a restricted workspace when possible.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:61- Finding
Authentication Troubleshooting Prints the Complete API Key
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
references/harness-list.md:5- Finding
Third-Party Agent Packages Are Downloaded and Executed Without Immutable Version Pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs setting
defaultPermissionstoapprove-all, which disables interactive safety checks for all acpx operations in automated use. In a delegation skill that can spawn external harnesses and execute tasks on behalf of a coordinator, this materially increases the chance of unauthorized file access, command execution, or dangerous tool actions without user review.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The recommended configuration combines
defaultPermissions: "approve-all"withauthPolicy: "skip", effectively removing interactive approval and authentication safeguards for delegated agents. In this skill's context—delegating actions to external ACP-enabled harnesses—this materially increases the chance of unauthorized file modification, command execution, or other unintended actions if the harness, prompt chain, or upstream package is compromised.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill tells users to place
ANTHROPIC_API_KEYin environment variables or a persistent config file but does not warn about secret handling risks such as shell history exposure, file permission issues, accidental logging, or committing config files. Because this skill is specifically about delegating to external runtimes, mishandled credentials could enable unauthorized access to paid model APIs or downstream agent actions.- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md ## 相关文件 - Skill 配置：`~/.openclaw/skills/acp-harness-delegation/SKILL.md` - Harness 列表：`~/.openclaw/skills/acp-harness-delegation/references/harness-list.md` - acpx 全局配置：`~/.acpx/config.json` - Claude API Key 配置：`~/.acpx/config.json` 的 `authCredentials` 字段
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 87% confidence
- Finding
npx -y opencode-ai acpinvokes a package without any version constraint, which allows the latest published package to be fetched and executed at runtime. In an automation/delegation skill, this increases supply-chain risk because a compromised or malicious upstream release could be executed with the user's local permissions.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document explicitly recommends storing
ANTHROPIC_API_KEYin~/.acpx/config.jsonin plaintext without warning about file permissions, secret-management alternatives, or exposure risks. Plaintext local credential storage can lead to token disclosure through backups, accidental commits, overly broad filesystem access, or local compromise.- Content