acpx-team

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:26 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent multi-agent orchestration guide, but it under-discloses high-impact delegated execution and mutable global installs.

Install only if you intentionally want multi-agent coding delegation. Verify package names and publishers, pin versions where possible, avoid global `latest` installs, and prefer default, plan, deny-all, or narrowly scoped read approval. Do not use `--approve-all`, `dontAsk`, `bypassPermissions`, or fire-and-forget execution outside a disposable branch, sandbox, or CI runner with minimal credentials. Use private temporary directories and clean up or close sessions that may retain sensitive context.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:11

Finding

Unpinned Global Installation of Third-Party Packages

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:11-16, with additional global installation commands at SKILL.md:136-145
Vulnerability Type: Supply-chain exposure through unpinned, globally installed dependencies
Risk Level: High

Vulnerable Code

bash

## Prerequisites

```bash
npm i -g acpx@latest

Install the target agents you want to use (e.g., npm i -g @anthropic-ai/claude-code).

text

The supported-agent table also directs users to install several packages globally without exact versions:

```markdown
| Claude Code | `acpx claude` | `npm i -g @anthropic-ai/claude-code` |
| Codex | `acpx codex` | `npm i -g @openai/codex` |
| OpenCode | `acpx opencode` | `npm i -g opencode-ai` |
| Gemini CLI | `acpx gemini` | `npm i -g @anthropic-ai/gemini-cli` |
| GitHub Copilot | `acpx copilot` | `npm i -g @githubnext/github-copilot-cli` |
| Qwen Code | `acpx qwen` | `npm i -g @qwen/qwen-code` |

Technical Analysis

The prerequisite uses the mutable latest distribution tag, while the other installation commands omit versions entirely. Consequently, the code installed by a user may differ from the code that existed when the Skill was reviewed.

npm packages can execute lifecycle scripts during installation. If an upstream account, package, release process, or registry response is compromised, following these commands can execute attacker-controlled installation logic. The use of global installation increases exposure because the package is placed in the user's global executable environment rather than being isolated to a locked project dependency tree.

The documentation does not provide exact versions, integrity hashes, lockfiles, publisher-verification steps, or guidance for disabling lifecycle scripts.

Attack Path

1. An attacker compromises one of the documented package publishers, its release process, or an accepted dependency.
2. The attacker publishes a malicious version u ...[truncated 885 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every dependency to an exact, reviewed version instead of using @latest or an omitted version.
• Record and verify package integrity hashes and distribute a reviewed lockfile where applicable.
• Confirm package names and publishers against their official project documentation.
• Prefer a project-local, isolated installation over npm i -g.
• Run installation and delegated agents inside a sandbox or disposable container with minimal filesystem and network access.
• Consider installing with lifecycle scripts disabled, such as npm install --ignore-scripts, unless a reviewed package explicitly requires them.
• Establish an update process that reviews release provenance, dependency changes, and lifecycle scripts before changing pinned versions.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:141

Finding

Potentially Mismatched Gemini CLI Package Publisher

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:141
Vulnerability Type: Suspicious package identity and possible unintended dependency installation
Risk Level: High

Vulnerable Code

markdown

| Gemini CLI | `acpx gemini` | `npm i -g @anthropic-ai/gemini-cli` |

Technical Analysis

The entry describes a Gemini CLI but instructs users to install a package under the @anthropic-ai namespace. Elsewhere in the same document, that namespace is associated with Claude Code. This vendor and product mismatch is a concrete package-identity warning.

The repository contains no verification that this package is the intended Gemini adapter, no exact version, and no integrity information. Installing an unintended npm package is security-sensitive because package lifecycle scripts may run immediately and a global installation exposes the resulting executable through the user's command environment.

This finding identifies the documented mismatch; it does not assert, without external verification, that the referenced package is malicious.

Attack Path

1. A user selects Gemini as an agent based on the supported-agent table.
2. The user copies the documented npm i -g @anthropic-ai/gemini-cli command.
3. npm resolves and installs that package without an exact version or documented publisher validation.
4. If the package is unintended, untrusted, or later compromised, its lifecycle scripts execute during installation.
5. Its globally installed executable can subsequently operate with the invoking user's access.

Impact Assessment

If the package reference is incorrect or resolves to a malicious component, exploitation can result in arbitrary code execution with the installing user's privileges. The affected scope may include source repositories, user credentials, environment variables, agent configuration, and other files accessible to the user. Elevated installation would increase the possible scope.

Remediation

View remediation

Remediation Suggestions

• Verify the intended Gemini CLI package and official publisher through authoritative vendor documentation.
• Correct the package name if the existing namespace is erroneous.
• Pin the verified package to an exact reviewed version and publish its expected integrity hash.
• Add an explicit publisher-verification step to the installation documentation.
• Avoid global installation and execute the package in a least-privilege sandbox.
• Add automated documentation checks that detect inconsistent vendor names and package namespaces.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:91

Finding

Delegated Agents Can Execute Actions Without Approval or Permission Checks

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:91-95, SKILL.md:150-159, and SKILL.md:181-186
Vulnerability Type: Excessive delegated-agent permissions and bypass of security confirmation
Risk Level: High

Vulnerable Code

bash

**5. EXECUTE** — Delegate implementation to agents in parallel:

```bash
acpx --approve-all claude -s exec-claude "Implement the caching layer based on this design: $(cat /tmp/consensus.txt)" &
acpx --approve-all codex -s exec-codex "Write tests for the caching layer: $(cat /tmp/consensus.txt)" &
wait

text

The mode table also explicitly advertises bypassing all checks:

```markdown
| Mode | Behavior | Use When |
|---|---|---|
| `plan` | Plan only, no execution | Architecture, analysis |
| `default` | Ask before changes | Standard work |
| `acceptEdits` | Auto-accept edits | Trusted refactoring |
| `dontAsk` | Auto-accept everything | Batch tasks |
| `bypassPermissions` | Skip all checks | CI/automation |

The permissions section repeats the unsafe option:

bash

# Permissions
acpx --approve-all claude -s w "task"     # auto-approve all
acpx --approve-reads claude -s w "task"   # auto-approve reads
acpx --deny-all claude -s w "task"        # analysis only

Technical Analysis

The Skill recommends --approve-all for implementation tasks and documents modes that automatically accept actions or skip permission checks. These options remove the confirmation boundary that would otherwise let a user reject dangerous commands, writes, or other tool operations.

The risk is amplified because later agents consume source-derived content and output from other agents. Repository text, task descriptions, or an earlier agent response can contain adversarial instructions. If such instructions influence a write-capable agent while approval is disabled, the resulting tool calls may execute without independent authorization.

Automatic appro ...[truncated 1274 chars]

Remediation

View remediation

Remediation Suggestions

• Make --deny-all or an analysis-only mode the default for review and deliberation.
• Permit read access only when necessary through a narrowly scoped option such as --approve-reads.
• Require explicit, per-action approval for shell commands, file writes, dependency installation, network access, and destructive operations.
• Remove bypassPermissions and dontAsk from recommended workflows, especially CI examples.
• Do not use --approve-all on prompts containing repository content or other agent outputs.
• Treat all agent responses as untrusted input and clearly delimit them from orchestration instructions.
• Run implementation agents in disposable sandboxes with repository-scoped filesystem access, restricted network access, no ambient credentials, and resource limits.
• In CI, use short-lived tokens with minimal scopes and require review before generated changes are merged or deployed.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:39

Finding

Predictable Shared Temporary Files Permit Content Substitution and File-Clobbering Attacks

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:39-50, SKILL.md:76-85, SKILL.md:112-115; references/protocols.md:26-35, references/protocols.md:53-68, references/protocols.md:91-101, references/protocols.md:120-151, references/protocols.md:168-182, references/protocols.md:212-227; and references/roles.md:274-286
Vulnerability Type: Unsafe use of fixed filenames in a shared temporary directory
Risk Level: Medium

Vulnerable Code

Representative workflow from SKILL.md:39-50:

bash

# 2. Round 1: fan-out the same question to all agents in parallel
acpx --format quiet claude -s claude-r "Review src/auth.ts for security vulnerabilities. Be specific." > /tmp/r1-claude.txt &
acpx --format quiet codex -s codex-r "Review src/auth.ts for security vulnerabilities. Be specific." > /tmp/r1-codex.txt &
acpx --format quiet gemini -s gemini-r "Review src/auth.ts for security vulnerabilities. Be specific." > /tmp/r1-gemini.txt &
wait

# 3. Round 2: each agent sees all responses and revises
acpx --format quiet claude -s claude-r "Other reviewers said:\n[Codex]: $(cat /tmp/r1-codex.txt)\n[Gemini]: $(cat /tmp/r1-gemini.txt)\n\nRevise your assessment." > /tmp/r2-claude.txt &
acpx --format quiet codex -s codex-r "Other reviewers said:\n[Claude]: $(cat /tmp/r1-claude.txt)\n[Gemini]: $(cat /tmp/r1-gemini.txt)\n\nRevise your assessment." > /tmp/r2-codex.txt &
acpx --format quiet gemini -s gemini-r "Other reviewers said:\n[Claude]: $(cat /tmp/r1-claude.txt)\n[Codex]: $(cat /tmp/r1-codex.txt)\n\nRevise your assessment." > /tmp/r2-gemini.txt &
wait

Another example from references/roles.md:274-286 creates a fixed temporary file:

bash

# Create a custom role
cat > /tmp/custom-role.md << 'EOF'
[ROLE: Database Expert]
Analyze this from a database perspective. Focus on:
- Query efficiency and index usage
- Schema design and normalization
- Tra
...[truncated 2592 chars]

Remediation

View remediation

Remediation Suggestions

• Create a unique private workspace using mktemp -d rather than fixed files directly under /tmp.
• Set umask 077 before creating files so only the current user can access agent output.
• Install a cleanup trap, for example trap 'rm -rf -- "$TMPDIR_WORK"' EXIT, after validating that the variable is non-empty and contains the expected generated path.
• Store every intermediate file beneath the private directory and quote every path expansion.
• Use exclusive file creation and reject symbolic links where practical.
• Before consuming a file, verify that it is a regular file, is owned by the expected user, and has not been replaced.
• Avoid passing temporary file contents through shell interpolation when a direct, structured input channel is available.
• Assign separate temporary directories to concurrent workflow executions.
• Treat all intermediate agent output as untrusted data and retain human approval for any downstream write or command execution.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list is very broad and includes generic phrases like requests to review, implement, fix, or form a team, which could cause the skill to activate for ordinary user prompts without clear intent to invoke multi-agent delegation. Over-broad activation increases the chance that sensitive context is routed into external agents or that risky delegation features are surfaced unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation demonstrates --approve-all during parallel execution without adjacent warning text about unattended edits, command execution, or repository changes. Because the skill's core purpose is delegation to coding agents, examples like this can directly encourage unsafe real-world usage where multiple agents act with broad permissions simultaneously.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly documents modes such as auto-accept and bypassing permission checks, which reduce or eliminate human oversight during delegated agent execution. In a multi-agent delegation skill, this is particularly dangerous because it normalizes unattended code and system changes across multiple agents, increasing the chance of unsafe actions, prompt-injection propagation, or destructive modifications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Listing modes like acceptEdits, dontAsk, and especially bypassPermissions without a clear safety disclosure normalizes disabling protections that preserve system integrity. In the context of a tool designed to orchestrate multiple agents, these options magnify risk by enabling fast, large-scale, low-supervision actions across codebases and environments.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The --approve-all permission model enables autonomous execution decisions by the delegated agent rather than requiring human review for each action. While autonomy is part of the product's purpose, exposing it as a simple example without guardrails increases the likelihood of unsafe use, especially when the delegated task may involve code modification or tool execution.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

md

acpx --format json claude exec "task"     # NDJSON stream

# Permissions
acpx --approve-all claude -s w "task"     # auto-approve all
acpx --approve-reads claude -s w "task"   # auto-approve reads
acpx --deny-all claude -s w "task"        # analysis only

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

--approve-reads still introduces a degree of autonomous decision-making, but it is materially less dangerous than unrestricted approval because it limits actions to read operations. The risk mainly lies in silent access to sensitive repository contents or configuration data if the skill is triggered too broadly or used on sensitive workspaces.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

md

# Permissions
acpx --approve-all claude -s w "task"     # auto-approve all
acpx --approve-reads claude -s w "task"   # auto-approve reads
acpx --deny-all claude -s w "task"        # analysis only

# Lifecycle

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The 'Bidirectional Communication' section states that any agent can call any other agent through acpx and gives examples of one agent invoking another via the orchestrator. Later, the 'Gotchas' section says 'No direct agent-to-agent messaging: All communication goes through the orchestrator'; while technically nuanced, this is contradictory documentation because the earlier section presents inter-agent calling as direct capability.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.