Stone Acpx

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:50 AM UTC
• Version: 1.0.0

Overview

This skill is a small, disclosed guide for using the acpx CLI and does not show hidden, destructive, or unrelated behavior.

Before installing, prefer the pinned plugin-local acpx runtime for normal use. Only run npx acpx@latest in an isolated, intentional upgrade-check context, because it can execute whatever package version is current at that time.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Execution of a Mutable npm Package Version Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 19
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

markdown

- Use `npx acpx@latest` only for explicit manual experiments or upgrade checks, not as the default OpenClaw runtime backend.

Technical Analysis

The skill permits npx acpx@latest for manual experiments and upgrade checks. The latest tag is mutable and does not identify a specific audited package artifact. When invoked, npx may retrieve and execute the package version currently associated with that tag, including its transitive dependencies and lifecycle behavior.

Consequently, the effective executable payload can change after this skill has been reviewed. If the package publisher, npm account, registry distribution channel, release process, or dependency tree is compromised, following this instruction could execute unreviewed code locally.

The instruction limits this command to explicit experiments or upgrade checks and separately recommends a pinned plugin-local runtime, reducing likelihood. However, it does not remove the supply-chain execution risk when the permitted exception is used.

Attack Path

1. An operator requests a manual experiment or upgrade check.
2. The agent follows the permitted instruction and invokes npx acpx@latest.
3. npx resolves the mutable latest tag using the configured npm registry.
4. It downloads the current package release and any required dependencies if they are not already available locally.
5. A compromised or malicious release, dependency, or registry response executes under the invoking user's account.
6. The malicious code can act within that account's process, filesystem, network, and credential-access boundaries.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running npx. Depending on the local environment a ...[truncated 416 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the authorization to execute npx acpx@latest.
• Use only the documented plugin-local binary backed by the managed, pinned dependency.
• If a separate upgrade check is necessary, query package metadata without executing the package.
• Test upgrades using an exact version in an isolated, least-privileged environment with no production credentials or sensitive repository access.
• Verify package provenance and integrity before execution, including lockfile and integrity-hash validation.
• Subject each proposed version and its transitive dependency changes to security review before updating the managed runtime.
• Where supported, restrict package lifecycle scripts and outbound network access during validation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

For the full upstream reference, read:

- https://raw.githubusercontent.com/openclaw/acpx/main/skills/acpx/SKILL.md
- https://raw.githubusercontent.com/openclaw/acpx/main/docs/CLI.md