Acpx Harness Routing

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:50 AM UTC
• Version: 1.0.0

Overview

This skill is a harness-routing guide, but it requires delegated agents to run with blanket approval and no interactive checks, which can allow unintended file or command changes.

Install only if you intentionally want a Chinese-language workflow for delegating work through ACPX harnesses. Before using it on valuable repositories or sensitive data, require explicit task boundaries, review generated changes, and avoid blanket approval unless the delegated worker is sandboxed and limited to the intended workspace.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:5
• Finding: Mandatory External Harness Routing Overrides Normal Agent Decision-Making## Vulnerability Details **File Location**: `SKILL.md`, line 5 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Skill Text ```text When a task is explicitly related to harness, Claude, Codex, or Gemini ACPX scheduling, this skill must be forcibly applied. ``` Related mandatory directives also appear at lines 18 and 200: ```text Harness tasks must use this skill. Harness tasks must enter this skill first. ``` ### Technical Analysis The skill uses mandatory language to take control of task routing whenever a task is classified as harness-related. It then prescribes which external agent should receive particular categories of work and which invocation mechanism must be used. This behavior can override the agent's normal context-sensitive routing and safety decisions. The triggering scope is broad because it includes any task involving Claude, Codex, Gemini, ACP runtime, or direct ACPX. Once loaded, the skill presents these routing requirements as compulsory rather than optional operational guidance. Although the file does not contain executable code, skill instructions themselves influence agent behavior. A task that merely mentions one of the covered systems may consequently be redirected through an external harness without a separate, task-specific confirmation. ### Attack Path 1. The skill is loaded into an agent session. 2. A user request is classified as involving Claude, Codex, Gemini, ACPX, or a harness workflow. 3. The mandatory routing rule activates. 4. The agent bypasses its ordinary routing discretion and selects the execution path prescribed by the skill. 5. The task context or workspace may be exposed to a delegated harness according to that route. 6. Any unsafe behavior produced by the delegated worker is compounded by the blanket-approval requirement described in the separate finding. ### Impact Assessment The immediate privilege obtained is c ...[truncated 523 chars]
• Remediation: ## Remediation Suggestions 1. Replace mandatory routing language with optional, context-sensitive recommendations. 2. Require explicit user confirmation before delegating data or execution to an external harness. 3. State that system, developer, user, and platform security policies always take precedence over the skill. 4. Narrow the activation criteria so that merely mentioning an agent or harness does not trigger delegation. 5. Present the intended agent, data scope, workspace path, and requested capabilities before invocation. 6. Allow the controlling agent to decline delegation when the request is sensitive, ambiguous, or can be completed safely without an external worker. 7. Minimize the prompt and filesystem content supplied to delegated agents.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:96
• Finding: Blanket Approval Disables Granular Authorization for Harness Operations## Vulnerability Details **File Location**: `SKILL.md`, lines 96–99 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: High ### Vulnerable Skill Text ```bash --approve-all --non-interactive-permissions deny ``` The surrounding instruction declares this combination mandatory and states that it cannot be omitted. ### Technical Analysis The `--approve-all` option removes per-action approval for operations requested through direct ACPX. The skill requires this setting for all ACPX or harness scheduling rather than evaluating the permissions needed by each task. The accompanying non-interactive denial option prevents waiting for interactive permission input, but it does not neutralize the danger of actions already covered by blanket approval. Consequently, a mistaken, compromised, or prompt-injected delegated worker may be able to use every capability exposed by the harness without granular human review. This violates least-privilege principles. Authorization should be restricted by operation, resource, workspace, and duration rather than globally approved to avoid timeouts. ### Attack Path 1. A task is routed to direct ACPX under the skill's mandatory rules. 2. The controlling agent invokes ACPX with `--approve-all`. 3. The delegated worker receives an untrusted, malformed, or prompt-injected instruction, or independently generates an unsafe action. 4. The worker requests an operation available through its configured tools, such as modifying files or executing commands. 5. The blanket-approval setting allows covered operations to proceed without individual review. 6. The operation affects resources accessible to the ACPX process before the controlling agent can intervene. ### Impact Assessment The obtainable privileges are bounded by the operating-system account, sandbox, tool configuration, and workspace access of the ACPX process. Within those boundaries, the worker may b ...[truncated 433 chars]
• Remediation: ## Remediation Suggestions 1. Remove the universal `--approve-all` requirement. 2. Use deny-by-default permissions with an explicit allowlist for the minimum tools and operations required by each task. 3. Require approval for command execution, access outside the designated workspace, destructive writes, network access, and sensitive-file access. 4. Run delegated workers in a sandbox under an unprivileged account. 5. Restrict filesystem access to a task-specific workspace and mount unrelated paths as inaccessible or read-only. 6. Apply command, network, resource, and execution-time limits independently of approval behavior. 7. Treat timeouts as operational failures rather than resolving them by expanding authorization. 8. Log requested and approved operations so that delegated activity remains attributable and auditable. 9. If unattended execution is necessary, use task-specific capability grants that expire when the invocation ends.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly mandates 'approve-all' and non-interactive execution for all acpx/harness delegation, but does not require any user-facing disclosure that delegated agents may modify files or execute impactful actions automatically. This removes a safety checkpoint and can cause silent code, file, or environment changes under broad authorization, especially because the skill frames the behavior as mandatory rather than conditional.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill states as a verified fact that Claude/Codex can 'realistically write files' but does not pair that capability with a mandatory warning, consent step, or safety boundary for users. In context, this is more dangerous because the same skill also requires fully approved, non-interactive harness execution, increasing the chance of unnoticed destructive or unintended workspace changes.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The natural-language instructions are entirely presented in Chinese and use mandatory phrasing throughout, but the document does not offer the user a language/locale option or explain that the skill is intentionally region-specific. Per the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Static analysis

No suspicious patterns detected.