Security audit

Acp Coder

Security checks for vulnerabilities and agentic risk

Overview

This coding-delegation skill appears useful, but its installer and triggers grant broad persistent agent authority with limited scoping or consent.

Review this skill carefully before installing. Only use it if you are comfortable with persistent OpenClaw configuration changes, broad agent delegation, cross-session visibility, and reduced approval prompts; prefer an installer or configuration that makes those features explicit opt-in and provides a backup or rollback path.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The installer sets `plugins.entries.acpx.config.permissionMode` to `approve-all`, which removes interactive approval barriers for ACP operations. In a skill designed to delegate coding tasks to external agents, this materially increases the blast radius of any prompt injection, agent misuse, or compromised downstream tool by allowing sensitive actions to proceed automatically.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Enabling `tools.sessions.visibility all` and `tools.agentToAgent.enabled true` expands access across sessions and permits inter-agent communication beyond basic single-task code delegation. This can expose data from unrelated sessions and lets one agent influence another, increasing the risk of lateral movement, unintended data sharing, or prompt-context leakage if any delegated agent is compromised or behaves unsafely.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The README states that the skill auto-triggers on a wide set of common coding phrases, including broad requests such as review, debug, develop, and code analysis. In a skill that delegates work to external agents, overly broad triggering can cause unintended invocation, sending project context or code to external tools when the user did not clearly intend delegation.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The installation steps describe automatic local environment changes, including modifying OpenClaw configuration, enabling cross-session access, installing binaries, configuring callbacks, and restarting the daemon, without an explicit warning or consent checkpoint in the documentation. This is risky because users may run setup expecting a simple install while the script changes trust boundaries and service behavior in ways that affect security and privacy.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger list is overly broad and includes generic terms like 'review', 'fix', 'debug', 'develop', and '看下项目', which can match ordinary conversation and cause this high-capability delegation skill to activate too often. In context, that increases the chance of unnecessary spawning of external agents, unintended project access, and execution of coding workflows when the user may have only wanted lightweight discussion or clarification.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The script directly rewrites `~/.openclaw/openclaw.json` to add heartbeat settings without an explicit warning, prompt, or backup step. Silent modification of a user's security-relevant configuration can introduce persistent behavior changes the user did not knowingly approve and may weaken their expected control over agent execution flow.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.destructive_delete_command

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: setup.sh:105

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: README.md:78