Virtuals Protocol Acp

AdvisoryAudited by Static analysis on May 10, 2026.

Overview

Detected: suspicious.dangerous_exec

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

An agent using this skill could create paid marketplace jobs or otherwise trigger financial/business actions if the user gives a broad request without realizing a payment flow is involved.

Why it was flagged

Creating a job can trigger payment handling through ACP, but the skill instructions do not specify a mandatory user approval, fee cap, balance cap, or provider/offering review step before that action.

Skill content

Payments are handled automatically by the ACP protocol — you only need to create the job and poll for the result.

Recommendation

Require explicit user confirmation before `job create`, token launch, profile updates, sell/delete actions, or any operation involving funds; set spending limits and confirm the provider, offering, fee, and required funds first.

ConcernHigh Confidence

ASI05: Unexpected Code Execution

What this means

If the user registers and serves an offering, incoming jobs could cause broad local or external actions depending on the handler the agent creates.

Why it was flagged

The seller guide explicitly allows offering handlers to execute arbitrary local logic, scripts, subprocesses, on-chain operations, or other workflows, without describing sandboxing or approval boundaries.

Skill content

`executeJob` can do anything — there are no constraints on what runs inside it... Code/script execution — run a script, shell command, or subprocess

Recommendation

Review and sandbox every generated handler, validate all incoming requirements, avoid shell/subprocess use unless necessary, and require manual approval for on-chain, file, hardware, or other high-impact actions.

ConcernHigh Confidence

ASI10: Rogue Agents

What this means

The agent may keep serving offerings and accepting jobs after the initial setup unless the user monitors and stops the runtime.

Why it was flagged

The documented seller runtime is a long-running WebSocket service; the README also documents `serve start`, `serve stop`, logs, and a stored `SELLER_PID`, showing persistent background operation.

Skill content

Seller Runtime — register offerings and serve them via WebSocket

Recommendation

Start the seller runtime only when intentionally selling services, monitor logs and PID state, stop it when finished, and prefer an explicit lifetime or auto-stop policy.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Anyone with access to the config file may be able to act as the configured ACP agent and use its wallet/account capabilities.

Why it was flagged

The skill legitimately needs ACP account credentials, but the agent is instructed to participate in setup and write an API key into a local config file.

Skill content

performs login/authentication and generates/writes an API key to `config.json`. You must run it for the user

Recommendation

Run setup under user supervision, keep `config.json` private and git-ignored, use a low-balance or purpose-specific agent wallet, and rotate the API key if exposed.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Sensitive prompts, secrets, or private data included in job requirements or resource parameters could be shared with external agents or services.

Why it was flagged

The skill intentionally communicates with other agents and their resource URLs; parameters and job requirements may be sent outside the local environment.

Skill content

`acp resource query <url> [--params '<json>']` — Query an agent's resource by its URL. Makes an HTTP request to the resource URL

Recommendation

Treat marketplace agents and resource URLs as untrusted, verify destinations, and avoid sending secrets or private data unless the user explicitly approves.

NoteMedium Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users rely on the supplied repository contents and npm dependencies when running the CLI.

Why it was flagged

The artifacts include a package-based CLI and lockfile, but the registry source is unknown and there is no install spec tying installation to a verified source.

Skill content

Source: unknown ... No install spec — this is an instruction-only skill.

Recommendation

Install only from a trusted copy, review `package.json` and `package-lock.json`, and avoid running setup from an unverified directory.

Findings (4)

critical

suspicious.dangerous_exec

Location: src/commands/serve.ts:86
Finding: Shell command execution detected (child_process).

critical

suspicious.dangerous_exec

Location: src/commands/setup.ts:52
Finding: Shell command execution detected (child_process).

critical

suspicious.dangerous_exec

Location: src/lib/config.ts:142
Finding: Shell command execution detected (child_process).

critical

suspicious.dangerous_exec

Location: src/lib/open.ts:20
Finding: Shell command execution detected (child_process).