Agent Communication Protocol

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:14 PM UTC
• Version: 0.1.1

Overview

The skill is a coherent ACP messaging plugin guide, but it asks users to install mutable remote code, expose a generated credential in chat, and grant broad identity privileges.

Install only if you trust the remote ACP plugin repositories and are comfortable with a network-facing agent identity. Before use, pin and review the plugin version, avoid printing or sharing seedPassword, replace allowFrom ["*"] with trusted AIDs, review any agent.md content before sync, and avoid granting operator admin scopes unless you understand why they are required.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

• Location: resources/install.md:36
• Finding: Unpinned Third-Party Plugin and Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `resources/install.md:36-43` **Vulnerability Type**: Untrusted and unpinned software supply chain **Risk Level**: High ### Vulnerable Instructions ```text If ~/.openclaw/extensions/acp/.git exists, enter that directory and execute git pull. Otherwise: - Clone https://github.com/coderXjeff/openclaw-acp-channel.git into ~/.openclaw/extensions/acp. - If GitHub is unavailable, clone https://gitee.com/yi-kejing/openclaw-acp-channel.git instead. - Run npm install inside ~/.openclaw/extensions/acp. ``` ### Technical Analysis The installation procedure retrieves the current state of a remote Git branch and immediately installs its dependency graph. It does not pin an audited commit or release tag, verify a cryptographic checksum or signed commit, enforce a trusted lockfile, or disable package lifecycle scripts. The fallback repository is hosted under a different account from the primary repository. The instructions do not establish that both repositories are controlled by the same trusted publisher or contain identical content. Because the downloaded project is installed as an OpenClaw Gateway plugin, any malicious JavaScript package lifecycle script or modified plugin source can execute with the permissions of the OpenClaw process. The reviewed project does not itself contain the remote plugin source, so the effective runtime payload can change after this Skill is audited. ### Attack Path 1. An attacker compromises the primary repository, the fallback mirror, a maintainer account, or a transitive npm dependency. 2. The attacker publishes malicious plugin code or a malicious package lifecycle script. 3. The Skill directs the Agent to run `git pull` or clone the current remote branch without validating a fixed revision. 4. The Agent runs `npm install`, which may execute dependency lifecycle scripts. 5. The Skill enables the ACP plugin and instructs the user to restart the Gateway. 6. The attacker-controlle ...[truncated 463 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the plugin to a reviewed commit hash or cryptographically signed release instead of using a moving branch. 2. Verify the downloaded revision against an independently published SHA-256 digest or a trusted signing key. 3. Require a committed, reviewed dependency lockfile and use `npm ci` rather than unconstrained `npm install`. 4. Use `npm ci --ignore-scripts` where package lifecycle scripts are not strictly required. 5. Audit all lifecycle scripts before permitting them to run. 6. Remove the fallback mirror unless its ownership and synchronization process can be verified. If retained, require the same pinned commit and digest as the primary repository. 7. Install and test the plugin in a restricted environment before enabling it in the Gateway. 8. Run OpenClaw under a dedicated least-privileged operating-system account with limited filesystem and network access. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: resources/install.md:249
• Finding: Generated ACP Seed Password Is Disclosed in the Completion Report<![CDATA[ ## Vulnerability Details **File Location**: `resources/install.md:100-103, 249-251` **Vulnerability Type**: Sensitive credential exposure through Agent output **Risk Level**: High ### Vulnerable Instructions ```text When the user has not supplied a value: - Generate SEED_PASSWORD with crypto.randomBytes(16) as 32 hexadecimal characters. The mandatory completion report includes: Automatically generated: - seedPassword: {SEED_PASSWORD} - allowFrom: ["*"] ``` ### Technical Analysis The password-generation method uses a cryptographically secure random source. The vulnerability is that the generated secret is subsequently included verbatim in the Agent's final conversational response. Agent responses may be retained in chat history, API logs, observability systems, support exports, screenshots, browser storage, or shared transcripts. Consequently, a secret that should remain confined to protected configuration storage is copied into multiple systems with broader and less predictable access controls. This is a credential-handling flaw rather than a weakness in the random-number generator. ### Attack Path 1. The installation process generates a new ACP seed password. 2. The password is written into the OpenClaw configuration. 3. The mandatory completion template instructs the Agent to print the same password in its response. 4. The response is stored in a transcript, API log, telemetry system, screenshot, or support export. 5. A person or service with access to that secondary storage obtains the password. 6. The exposed password may be used against the ACP identity or its encrypted key material, depending on the ACP authentication and recovery semantics. ### Impact Assessment Exposure compromises the confidentiality of the ACP identity credential. Depending on the external ACP implementation, possession of the password may facilitate identity authentication, recovery, impersonation, private-key decryption, or denial of service. At minimum, it fo ...[truncated 89 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `seedPassword` from all completion templates and normal Agent output. 2. Report only that a password was generated and stored successfully. 3. If a status field is necessary, display a fixed redaction such as `seedPassword: [REDACTED]`. 4. Store the secret in an operating-system credential store or a permission-restricted secret file rather than ordinary configuration where supported. 5. Restrict configuration permissions to the OpenClaw service account. 6. Ensure diagnostic logs, error messages, backups, and preflight output redact this field. 7. If a user must receive the secret, use a dedicated one-time secret-delivery mechanism after explicit confirmation rather than the normal chat transcript. 8. Rotate any seed passwords previously disclosed through Agent responses. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: resources/multi-identity.md:229
• Finding: ACP Identity Provisioning Assigns Broad Administrative Operator Scopes<![CDATA[ ## Vulnerability Details **File Location**: `resources/multi-identity.md:229-250` **Vulnerability Type**: Excessive privileges assigned during identity registration **Risk Level**: High ### Vulnerable Configuration ```json { "id": "<NEW_UUID>", "label": "<agentId>", "role": "operator", "scopes": [ "operator.admin", "operator.approvals", "operator.pairing" ], "isDefault": false, "createdAtMs": "<current timestamp in milliseconds>", "lastActiveAtMs": "<current timestamp in milliseconds>", "channels": ["acp"] } ``` ### Technical Analysis The instructions register each new ACP communication identity as an `operator` and grant administration, approval, and pairing scopes. These privileges are broader than the evident requirements for ACP messaging or displaying an identity in the user interface. The document does not explain why an ACP channel identity needs all three scopes, require explicit owner authorization for the escalation, or provide a reduced-scope alternative. This violates least-privilege principles and increases the consequences of identity compromise, routing mistakes, or incorrect identity-file edits. The exact enforcement behavior depends on the external OpenClaw runtime, which is not included in this documentation-only project. Nevertheless, the configuration explicitly requests privileged scopes and should be treated as an authorization risk. ### Attack Path 1. A new ACP identity is created for messaging or multi-identity routing. 2. The Agent edits the device identity file and assigns the identity the `operator` role. 3. The identity receives `operator.admin`, `operator.approvals`, and `operator.pairing`. 4. An attacker compromises, impersonates, or becomes incorrectly bound to that identity. 5. If the OpenClaw runtime enforces these scopes as documented, the attacker can invoke privileged operator functions beyond ACP messaging. ### Impact Assessment Potentially exposed privileges include admini ...[truncated 496 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not modify device authorization records merely to make an ACP identity visible in the interface. 2. Define a dedicated ACP role with only the permissions required for messaging, status checks, and profile synchronization. 3. Remove `operator.admin`, `operator.approvals`, and `operator.pairing` unless each scope is demonstrably required. 4. Require explicit owner confirmation before granting any administrative scope. 5. Validate authorization independently from channel identity and message-routing bindings. 6. Prevent an ACP `accountId`, AID, or routing entry from automatically inheriting device-operator privileges. 7. Add startup validation that rejects duplicate, unknown, or conflicting identity bindings. 8. Log privileged scope changes and alert the owner when an identity gains administrative capabilities. 9. Periodically audit existing device identity files and revoke excessive scopes from previously provisioned ACP identities. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (22)

Ae1

High

• Category: analysis-evasion

Content

- **[多身份模式](./resources/multi-identity.md)** — 多 Agent 多 AID 架构，agents.list 定义、identity 绑定、人格隔离、workspace 配置、身份创建/删除全流程。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill description is written as an instruction to operate in Chinese and does not indicate that the language is optional or user-selectable. This creates a locale/language policy concern because the skill appears to require a specific language without documented opt-in or justification.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation states that agent.md is automatically uploaded on ACP connection and then publicly accessible via a URL, but it does not clearly warn users that its contents become public. This creates a real privacy and information disclosure risk because users may include sensitive operational details, identities, capabilities, or personal data in agent.md under the assumption that it is local metadata.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: In workspace mode, the plugin auto-generates agent.md by extracting content from multiple local workspace files and then uploads it, but the documentation does not clearly warn that local files are being transformed into publicly retrievable content. This is more dangerous in context because files like IDENTITY.md, SOUL.md, AGENTS.md, TOOLS.md, HEARTBEAT.md, and skill summaries can contain sensitive internal descriptions, capabilities, operational context, or personal metadata that users would not expect to be published.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation provides a copy-pastable configuration that sets `allowFrom: ["*"]`, which effectively permits messages from any AID, while also showing a `seedPassword` field without any security warning. In a security-sensitive messaging/channel plugin, this can normalize unsafe defaults and lead users to deploy agents with overly broad access and sensitive credential material in plaintext configuration.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

| `PREFLIGHT_FAIL` + `is used by another user` | AID 被占用 | 更换 `agentName` |
| `PREFLIGHT_FAIL` + `signIn` | AID 已存在但密码不匹配 | 使用正确 `seedPassword` 或更换 `agentName` |
| `PREFLIGHT_FAIL` + `TIMEOUT` | 网络不可达 | 检查网络/代理 |
| `/acp` skill 不可用 | 插件未启用或 skill 未加载 | 检查 `plugins.entries.acp.enabled` 与 `skill/acp/SKILL.md` |

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

| `PREFLIGHT_FAIL` + `is used by another user` | AID 被占用 | 更换 `agentName` |
| `PREFLIGHT_FAIL` + `signIn` | AID 已存在但密码不匹配 | 使用正确 `seedPassword` 或更换 `agentName` |
| `PREFLIGHT_FAIL` + `TIMEOUT` | 网络不可达 | 检查网络/代理 |
| `/acp` skill 不可用 | 插件未启用或 skill 未加载 | 检查 `plugins.entries.acp.enabled` 与 `skill/acp/SKILL.md` |

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document states that receiving a message from a new AID automatically creates a contact record and initializes a trust-related credit score, and elsewhere it also documents automatic appending of AI-generated summaries into the contact's notes. These are implicit state and data modifications triggered by inbound activity rather than explicit user action, which can create privacy, data integrity, and consent issues—especially if users do not expect unsolicited entities to be persisted or annotated automatically.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly states that pulled group messages are persisted locally in a JSONL file under the user's home directory, but it does not warn that this stores conversation history on disk where it may be retained indefinitely, backed up, or exposed to other local users/processes depending on host security and file permissions. In a messaging/group-chat skill, silent local persistence increases privacy and confidentiality risk, especially for sensitive agent-to-agent conversations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill documents a `dissolve_group` operation without indicating that it is destructive or potentially irreversible, which can lead users or calling agents to delete a group unintentionally. In collaborative group chat contexts, dissolving a group can disrupt communications, remove access to shared state, and cause operational or data-loss consequences if users assume it is reversible.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill instructs the agent to back up and then modify `~/.openclaw/openclaw.json` and create local files, but it does not clearly warn the user up front that their persistent configuration and filesystem will be changed. This creates a consent and integrity risk: users may unknowingly authorize destructive or hard-to-audit local changes, especially when the same workflow can also restore from backup on validation failure.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The install instructions explicitly include the generated `seedPassword` in the final completion report, causing a sensitive credential to be displayed back to the user and potentially captured in chat history, logs, screenshots, or telemetry. In the context of an ACP identity bootstrap flow, exposing this secret weakens account security and can enable impersonation or unauthorized reuse if the transcript is accessible to others.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: 该 markdown 文件全文仅以中文提供说明，未说明这是特定区域专用文档，也未向用户提供语言或本地化选择。根据规则，若技能在自然语言层面强制特定语言且没有用户选择或明确合理的区域限定，应视为政策风险。

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation shows `seedPassword` values embedded directly in configuration examples and discusses their use for protecting private keys, but it does not clearly warn that these are sensitive secrets that must not be reused, logged, committed, or shared. In a real deployment, users often copy examples verbatim or store configs insecurely, which can expose key-encryption material and weaken identity protection.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 方式 A：使用 agents.list[].workspace 配置的自定义路径
WORKSPACE_DIR=~/.openclaw/workspace-funny-bot
mkdir -p "$WORKSPACE_DIR"

# 方式 B：省略 workspace 配置，核心代码自动分配
# 非默认 Agent 的默认路径为 ~/.openclaw/workspace-{agentId}

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 方式 A:使用 agents.list[].workspace 配置的自定义路径
WORKSPACE_DIR=~/.openclaw/workspace-funny-bot
mkdir -p "$WORKSPACE_DIR"

# 方式 B:省略 workspace 配置,核心代码自动分配
# 非默认 Agent 的默认路径为 ~/.openclaw/workspace-{agentId}

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The deletion procedure instructs users to remove agent configuration and workspace directories but lacks a strong warning that these actions may permanently destroy persona, memory, and operational data. Because the instructions are administrative and destructive, omission of backup/recovery guidance creates a real risk of irreversible data loss.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The file documents certificate registration and `agent.md` upload to remote ACP infrastructure without a clear warning that metadata and identity material are being transmitted to external services. This can lead operators to expose sensitive profile or behavioral information unintentionally, especially because `agent.md` is derived from workspace identity/persona files.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The entire skill document is written in Chinese and provides no indication that alternative languages are supported or that the locale restriction is intentional for a region-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: L003 写明“当用户询问 ACP 排名、活跃度分数、Agent 简介、Agent 搜索或 ACP 数据时使用”，其中“Agent 简介”“Agent 搜索”“ACP 数据”范围较宽，缺少明确边界、限定场景或排除条件。对于 markdown 文件，这类宽泛自然语言触发条件容易与普通对话需求重叠，增加非预期调用风险。

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# GET
curl -s "https://rank.agentunion.cn/search/text?q=助手&tags=assistant,chat&page=1&page_size=10"
# POST
curl -s -X POST "https://rank.agentunion.cn/search/text" \
  -H "Content-Type: application/json" \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# GET
curl -s "https://rank.agentunion.cn/search/vector?q=我需要写代码的助手&limit=10"
# POST
curl -s -X POST "https://rank.agentunion.cn/search/vector" \
  -H "Content-Type: application/json" \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.