Security audit

Acp Coder

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its stated goal of delegating coding work to external agents, but its installer grants broad persistent OpenClaw permissions and leaves those changes behind after uninstall.

Review this carefully before installing. It is not clearly malicious, but it changes persistent OpenClaw trust boundaries: approval-free ACP operation, all-session visibility, agent-to-agent access, auto-allowlisted local agents, heartbeat edits, daemon restart, and possibly a global npm install. Only install if you are comfortable with those settings, understand which agents will receive code/task context, and have a manual plan to restore OpenClaw configuration on uninstall.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: setup.sh:89
Finding: ACP Is Configured with Excessive Persistent Permissions
Content: View full analysis
/dev/null || echo "$ALLOW_JSON") openclaw config set acp.allowedAgents "$MERGED_JSON" # Cross-session access openclaw config set tools.sessions.visibility all openclaw config set tools.agentToAgent.enabled true ``` ### Technical Analysis The installer persistently sets the ACP permission mode to `approve-all`, which removes interactive approval from agent operations. It also configures session visibility as `all` and enables agent-to-agent communication globally. These permissions are broader than necessary for delegating a coding task. A least-privilege implementation would only expose the parent session and explicitly created child sessions, and it would require approval for sensitive file, command, network, or configuration operations. The impact is amplified because every locally detected coding agent is merged into the persistent allowlist. The Skill does not independently establish the trustworthiness of those executables before granting them access. ### Attack Path 1. A user executes `setup.sh`. 2. The s ...[truncated 1228 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: setup.sh:48
Finding: Unpinned Global Package Is Installed from a Third-Party npm Registry
Content: View full analysis
/dev/null | grep -q "$PKG"; then info "Installing codex-acp platform binary ($PKG)..." npm install -g "$PKG" --registry=https://registry.npmmirror.com \ && ok "Installed $PKG" \ || warn "Installation failed; codex may not start through ACP. Install manually: npm install -g $PKG" else ok "codex-acp platform binary is ready ($PKG)" fi fi done ``` ### Technical Analysis The package name is platform-dependent, but no version is specified. npm therefore resolves a mutable current version at installation time rather than the version reviewed with this Skill. The package is also fetched from `registry.npmmirror.com`, a third-party mirror, without an integrity value, signature verification, or comparison against authoritative package metadata. A package publisher compromise, malicious new release, package-name takeover, or mirror compromise could alter the code installed after this audit. Because the package is installed globally, its executable becomes available outside this Skill and remains present across future sessions. npm lifecycle scripts may also run during installation unless explicitly disabled. ### Attack Path 1. An attacker compromises the npm package publisher, publishes a malicious new version, or compromises the configured mirror. 2. The user has Codex installed and runs `setup.sh`. 3. The script constructs the platform package name and requests it without a pinned version. ...[truncated 929 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: README.md:76
Finding: Documented Uninstall Leaves Elevated ACP Configuration Active
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 78)May include surrounding context.
bash
# 删除 skill rm -rf ~/.openclaw/workspace-assistant/skills/acp-coder openclaw daemon restart

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 78)May include surrounding context.
bash
# 删除 skill rm -rf ~/.openclaw/workspace-assistant/skills/acp-coder openclaw daemon restart

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a coding-task delegator, but its instructions also direct the agent to suggest or perform environment setup, package installation, configuration changes, and daemon restarts. That materially expands its operational scope into host administration, which can surprise users and increase the chance of unsafe system modification under the guise of normal coding help.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README introduces the skill as delegating coding tasks to external agents but does not present this as a clear security warning or privacy notice. In context, this omission is significant because users may paste proprietary code or request analysis without realizing their task will be routed to external coding agents.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The installation section describes a setup script that changes OpenClaw configuration, enables cross-session access, installs binaries, configures callbacks, and restarts the daemon, but it does not prominently warn users about these system-level changes before execution. This is risky because users may run the script without understanding that it alters trust boundaries and background services.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README states that the skill auto-triggers on a wide set of common coding phrases, which can cause unintended delegation of user requests to external coding agents. In this skill’s context, accidental activation is more dangerous because the delegated agents may access project code and perform actions across sessions, increasing the chance of unreviewed data exposure or code modification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases are broad enough to match many normal development utterances, increasing the chance that this powerful orchestration skill activates when a simpler, safer behavior would suffice. In context, over-triggering is more dangerous because the skill can spawn external agents and potentially lead to code changes or host-level actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructional text directs the agent in Chinese and the examples and reply templates consistently require Chinese responses, but there is no indication that the user may choose their preferred language. This imposes a locale/language behavior without opt-in, which matches the policy-violation category.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest says the skill should not be used for simple shell queries, yet the body instructs the orchestrator to handle those cases directly with exec. This inconsistency can bypass expected skill boundaries and cause the skill to execute commands in situations where callers believed it would only delegate coding work.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The prohibition at L514 says the orchestrator must not itself use exec/Read/write on code files. But L124 explicitly says to use exec for simple tasks, and multiple places such as L109 and L428-L429 instruct the orchestrator to directly read files written by child agents. This is an active contradiction in the skill's own guidance, not merely missing detail.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script’s comments, status messages, errors, and usage instructions are written in Chinese throughout, including the user-facing output. Because this is a code file and the language choice is imposed without opt-in or justification as a region-specific tool, it violates the natural-language locale policy criteria.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script performs an undisclosed global npm installation from a remote mirror, adding executable code to the host outside the stated skill behavior. This introduces supply-chain risk and unexpected system modification, especially because the package name is platform-derived and the registry is a third-party mirror rather than the default npm source.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The installer enables cross-session visibility and agent-to-agent communication, which materially broadens data access and delegation capabilities beyond a narrow coding-helper setup. In a multi-agent environment, this can expose other sessions' content and allow chained actions by external agents, increasing the blast radius if a delegated agent is compromised or misused.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.destructive_delete_command

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: setup.sh:105

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: README.md:78