BRICKS CLI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:07 PM UTC
• Version: 0.1.4

Overview

The skill is coherent for BRICKS management, but it needs review because it documents local device credentials, LAN access, persistent ACP configuration, and an ACP mode that can run project commands without confirmation.

Install only if you intend to let this skill manage real BRICKS workspaces and devices. Use pinned CLI/tool versions where possible, avoid `--approve-all` except in isolated trusted projects, disable ACP when idle, remove persistent acpx config after use, rotate away from default device passcodes, and avoid sending sensitive screenshots or files unless your policy allows it.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:270

Finding

Device MCP Passcode Transmitted over Plaintext HTTP and Exposed in Process Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:266-271; rules/connect-local-device.md:59-64
Vulnerability Type: Plaintext credential transmission and command-line secret exposure
Risk Level: High

Vulnerable Code

SKILL.md:266-271:

bash

# Bridge a device's MCP endpoint (requires passcode as Bearer token)
npx mcporter --url http://<device-ip>:19851/mcp --header "Authorization: Bearer <passcode>"

rules/connect-local-device.md:59-64:

bash

Use [mcporter](https://mcporter.dev) to bridge the device's MCP endpoint so Claude Code (or other MCP clients) can interact with it directly:

```bash
mcporter call --url http://<device-ip>:19851/mcp --header "Authorization: Bearer <passcode>"

text

### Technical Analysis

The instructions place an authentication passcode in an HTTP `Authorization` header while using an unencrypted `http://` endpoint. HTTP does not provide transport confidentiality or server authentication. A party able to observe or manipulate local-network traffic may recover the bearer credential or redirect the connection to an attacker-controlled endpoint.

The passcode is also embedded directly in the command-line arguments. Depending on the operating system and process isolation settings, command arguments may be visible to other local processes, process-monitoring utilities, shell history, terminal logging, or diagnostic collection.

Authentication is necessary for the declared MCP debugging functionality, but transmitting the credential without encrypted transport and placing it in a process argument exceeds the minimum safe exposure required.

### Attack Path

1. A user enables local debugging and MCP on a BRICKS device.
2. The user executes the documented `mcporter` command with the device passcode.
3. An attacker on the same network captures plaintext HTTP traffic, performs an active man-in-the-middle attack, or observes the local process c
...[truncated 726 chars]

Remediation

View remediation

Remediation Suggestions

• Require HTTPS with proper certificate validation or mutually authenticated TLS for the MCP endpoint.
• Do not silently fall back to plaintext HTTP.
• Pass credentials through a protected input mechanism, such as an interactive secret prompt, restricted credential file, or supported secret descriptor, rather than command-line arguments.
• Ensure credentials are redacted from logs, diagnostics, error output, and process telemetry.
• Use short-lived, device-specific, narrowly scoped tokens instead of reusable passcodes.
• Bind the MCP service only to trusted interfaces and enforce network-level access controls.
• Rotate any passcode that may already have been used through the documented command.

T09 · Insecure Skill Coding Practices

Error

• Location: rules/connect-local-device.md:18

Finding

Known Default Passcode for Local Device Debugging

Content

View full analysis

Vulnerability Details

File Location: rules/connect-local-device.md:12-18
Vulnerability Type: Predictable default authentication credential
Risk Level: High

Vulnerable Code

markdown

- **LAN Discovery** must be on for `bricks devtools scan` to find the device.
- **MCP** must be on for MCP bridging (step 3).
- A **Passcode** can be set in the same section (default: `BRICKS_DEVTOOLS`).

Technical Analysis

The documentation identifies BRICKS_DEVTOOLS as the default device passcode. A shared, publicly documented default is predictable and may remain unchanged on deployed devices. Because LAN discovery can expose device addresses and indicate whether a passcode is configured, an attacker on the same network can identify candidate devices and attempt the known default.

Local debugging legitimately requires authentication, but a universal default credential does not provide device-specific authentication and violates least-privilege credential design.

Attack Path

1. A device has local debugging, LAN discovery, and MCP enabled.
2. Its operator does not replace the default passcode.
3. An attacker with access to the same LAN scans for BRICKS DevTools devices or otherwise identifies the MCP service.
4. The attacker submits BRICKS_DEVTOOLS as the bearer passcode.
5. If the default remains active, the attacker obtains authenticated MCP access.
6. The attacker uses exposed MCP tools to inspect the device, read logs, trigger automations, or perform debugging actions.

Impact Assessment

Exploitation can grant unauthorized access to MCP functionality on every reachable device that retains the default. This may expose operational information, application logs, device state, and automation controls. A common default can also allow one known credential to affect multiple devices.

Remediation

View remediation

Remediation Suggestions

• Eliminate the shared default passcode.
• Generate a unique, cryptographically random credential for each device during setup.
• Require the operator to set a new credential before MCP or local debugging can be enabled.
• Reject known defaults and weak passcodes.
• Rate-limit failed authentication attempts and record security-relevant failures.
• Provide a straightforward credential-rotation and revocation process.
• Warn users prominently if local debugging is enabled with an unchanged or weak credential.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Global Installation and On-Demand Execution of Third-Party Packages

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16-21, SKILL.md:266-270; rules/use-desktop-acp.md:24-28
Vulnerability Type: Unpinned third-party dependency installation and execution
Risk Level: Medium

Vulnerable Code

SKILL.md:16-21:

bash

# Validate installed
which bricks

# npm (published by @fugood on npmjs.com — https://www.npmjs.com/package/@fugood/bricks-cli)
npm i -g @fugood/bricks-cli
# Bun
bun add -g @fugood/bricks-cli

SKILL.md:266-270:

bash

# Bridge a device's MCP endpoint (requires passcode as Bearer token)
npx mcporter --url http://<device-ip>:19851/mcp --header "Authorization: Bearer <passcode>"

rules/use-desktop-acp.md:24-28:

bash

[acpx](https://github.com/openclaw/acpx) is a headless CLI client for the Agent Client Protocol. It manages sessions, queues prompts, and streams agent output.

```bash
# Install acpx
npm install -g acpx

Technical Analysis

The instructions install @fugood/bricks-cli and acpx globally without exact versions and invoke mcporter through npx without a version. Resolution therefore depends on mutable registry state at execution time. A compromised maintainer account, malicious package release, registry compromise, or future package takeover could cause code not present during this audit to execute locally.

Global installation increases the duration and scope of the affected tool. npx may retrieve and execute a package immediately, creating a remote payload retrieval and execution channel through the package registry. This audit found no evidence that the named packages are currently malicious; the vulnerability is the unsafe, unpinned trust model.

Attack Path

1. An attacker compromises a package publisher or upstream package release process.
2. The attacker publishes a malicious version under one of the documented package names.
3. A user follows the Skill instructions witho ...[truncated 735 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every package to an exact reviewed version.
• Use lockfiles and verify package integrity hashes where supported.
• Replace unversioned npx mcporter with a pinned, locally installed dependency or an explicitly versioned invocation.
• Avoid global installation where a project-scoped dependency or isolated tool environment is sufficient.
• Disable or review package lifecycle scripts during installation where practical.
• Verify publisher identity, package provenance, signatures, and release checksums.
• Establish a controlled update process that reviews new versions before deployment.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: rules/use-desktop-acp.md:37

Finding

ACP Auto-Approval Enables Unconfirmed Shell Execution with Shared Project Tools

Content

View full analysis

Vulnerability Details

File Location: rules/use-desktop-acp.md:33-38, rules/use-desktop-acp.md:73-83
Vulnerability Type: Approval bypass and excessive agent execution privileges
Risk Level: High

Vulnerable Code

rules/use-desktop-acp.md:33-38:

bash

# Send a prompt
acpx --agent 'bricks desktop-acp-bridge' "list all files and summarize the project"

# Auto-approve all tool calls
acpx --agent 'bricks desktop-acp-bridge' --approve-all "fix the linting errors"

rules/use-desktop-acp.md:73-83:

markdown

## Key Details

- **Sessions are shared** — conversations created via ACP appear in BRICKS Project Desktop's GUI and vice versa
- **Settings are shared** — default model and provider config come from the app's settings (credentials are not exposed to the ACP client)
- **MCP is shared** — `.mcp.json` tools configured in the project are available to the ACP agent
- **Project scoped** — the agent operates in the `cwd` passed by the ACP client; the directory must contain `application.json`
- **Auto-approve** — bash commands run without approval in ACP mode (headless); use acpx `--deny-all` to override

## Security Considerations

- **Prefer `--deny-all` over `--approve-all`:** The `--approve-all` flag permits the agent to run arbitrary bash commands in the project directory without confirmation.

Technical Analysis

The documented --approve-all mode allows the bridged agent to execute tool calls, including arbitrary Bash commands, without user confirmation. The agent also receives project-scoped file access and the MCP tools configured in .mcp.json. Shared sessions create an additional trust boundary because content originating in the desktop GUI or ACP client can influence the same agent context.

This creates a prompt-injection-to-command-execution path. An attacker-controlled project file, prompt, session message, or tool output could instruct the model to run commands th ...[truncated 1438 chars]

Remediation

View remediation

Remediation Suggestions

• Make --deny-all the documented and implemented default for headless operation.
• Remove the --approve-all example from the primary workflow or place it behind a strongly emphasized exceptional-use section.
• Require explicit confirmation for shell commands, file writes, network operations, and MCP actions.
• Allowlist commands and MCP tools needed for each task rather than approving all tools.
• Run the bridge in a sandbox with a restricted filesystem, minimal environment variables, no unnecessary credentials, and constrained network access.
• Treat project files, shared sessions, prompts, and tool output as untrusted input.
• Separate sessions by trust domain and avoid sharing sensitive MCP state with untrusted prompts.
• Record command approvals and executions in a security audit log.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: rules/use-desktop-acp.md:48

Finding

Persistent ACP Agent Configuration Creates Lasting Project Access

Content

View full analysis

Vulnerability Details

File Location: rules/use-desktop-acp.md:46-60, rules/use-desktop-acp.md:84-85
Vulnerability Type: Persistent local agent registration with project-file access
Risk Level: Medium

Vulnerable Code

rules/use-desktop-acp.md:46-60:

markdown

### Persistent acpx config

Add to `~/.acpx/config.json` to avoid repeating `--agent`:

```json
{
  "agents": {
    "bricks": {
      "command": "bricks desktop-acp-bridge"
    }
  }
}

Then use as:

bash

acpx bricks sessions new

rules/use-desktop-acp.md:84-85:

markdown

- **Persistent config creates lasting access:** Writing `~/.acpx/config.json` means any process invoking `acpx bricks` can start an ACP session with project file access. Remove the config when not actively using ACP, especially on shared machines.
- **Disable ACP when idle:** Turn off "Enable ACP" in BRICKS Project Desktop Settings when not actively bridging to reduce the attack surface of the local Unix socket.

Technical Analysis

The configuration registers a persistent command alias in the user's home directory. While BRICKS Project Desktop is running with ACP enabled, a process capable of invoking acpx bricks can start a bridge session operating against a BRICKS project. The bridge shares sessions and MCP state and operates in the ACP client's selected working directory when it contains application.json.

The persistent configuration does not itself install an operating-system startup service, so it is not classified as system persistence. The risk is a durable capability registration that remains available after the immediate task and broadens the local attack surface. On shared systems, weak file permissions or compromised same-user processes can facilitate unintended use.

Attack Path

1. A user creates ~/.acpx/config.json with the persistent bricks agent entry.
2. The user later leaves BRICKS Project Desk ...[truncated 868 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer ephemeral command-line configuration instead of a persistent home-directory agent entry.
• Remove the configuration immediately after the required workflow completes.
• Disable ACP whenever it is not actively in use.
• Restrict ~/.acpx/config.json and the ACP Unix socket to the owning user with strict filesystem permissions.
• Require client authentication or a per-session capability token rather than relying only on local socket reachability.
• Scope ACP access to an explicitly selected project and reject unexpected working directories.
• Add idle timeouts and automatic session revocation.
• Combine persistent configuration, if unavoidable, with --deny-all and narrowly allowlisted tools.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

Use -ap or --auth-profile to override the active profile for any command, without switching the stored profile:

bash

# Run any command as a specific profile
bricks -ap staging device list
bricks --auth-profile production app list

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill explicitly documents taking and saving device screenshots but does not warn that screenshots may capture sensitive on-screen data such as credentials, personal information, internal dashboards, or customer content. In this skill's context, remote device management increases risk because an agent may collect or persist screenshots from production signage or managed endpoints without prompting the user to consider data exposure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

Applications

bash

# Create a new application
bricks app new -n "My App"
bricks app new -n "My App" -d "Description" --layout-width 192 --layout-height 108
bricks app new -n "My App" --example <key>     # Create from example template

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

Initialize local project from app

bricks app project-init bricks app project-init -o ./my-app bricks app project-init -y # Skip prompts, use defaults bricks app project-init --no-git # Skip git init

text

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.

md

Both `app` and `module` support these flags:
- `-o, --output <dir>` — output directory
- `-y, --yes` — skip prompts, use defaults
- `--no-git` — skip git initialization
- `--no-install` — skip `bun install`
- `--no-github-actions` — skip GitHub Actions workflow

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The media upload section describes sending local files, optional tags/descriptions, and AI analysis instructions to remote services without clearly warning that file contents and derived metadata leave the local environment. This is especially relevant here because the skill spans cloud APIs and AI-assisted processing, so users may unintentionally transmit confidential documents or images to external infrastructure.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The 'Auto-approve' capability is a genuine security risk because it removes human approval from bridged agent command execution in the project working directory. In the context of a desktop ACP bridge with shared sessions and MCP state, misuse could enable destructive shell commands, secret exposure, or tampering with source code and local environment.

Content

Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.

md

## Security

- **Auto-approve risk:** Running `acpx --approve-all` allows the bridged agent to execute bash commands without confirmation. Prefer explicit approval or `--deny-all` for untrusted prompts. Never combine `--approve-all` with persistent config in unattended/shared environments.
- **Persistent config:** Creating `~/.acpx/config.json` enables future ACP sessions without re-specifying the agent. This is convenient but means any process that invokes `acpx bricks` can start a session with project file access. Remove the config when not actively needed.
- **Device passcodes:** LAN device MCP bridging (`mcporter`) requires passing device passcodes as Bearer tokens. Treat passcodes as secrets — do not log or commit them.
- **LAN discovery:** `bricks devtools scan` broadcasts on the local network. Only run on trusted networks.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The 'Auto-approve' capability is a genuine security risk because it removes human approval from bridged agent command execution in the project working directory. In the context of a desktop ACP bridge with shared sessions and MCP state, misuse could enable destructive shell commands, secret exposure, or tampering with source code and local environment.

Content

Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.

md

## Security

- **Auto-approve risk:** Running `acpx --approve-all` allows the bridged agent to execute bash commands without confirmation. Prefer explicit approval or `--deny-all` for untrusted prompts. Never combine `--approve-all` with persistent config in unattended/shared environments.
- **Persistent config:** Creating `~/.acpx/config.json` enables future ACP sessions without re-specifying the agent. This is convenient but means any process that invokes `acpx bricks` can start a session with project file access. Remove the config when not actively needed.
- **Device passcodes:** LAN device MCP bridging (`mcporter`) requires passing device passcodes as Bearer tokens. Treat passcodes as secrets — do not log or commit them.
- **LAN discovery:** `bricks devtools scan` broadcasts on the local network. Only run on trusted networks.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill discloses that a default passcode is BRICKS_DEVTOOLS and then demonstrates passing credentials directly to an HTTP endpoint, without warning users to rotate the default or protect the secret. Publishing and encouraging use of a known default credential materially weakens access control because any device left with the default passcode may be trivially accessible to anyone on the same network.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs the user to scan the local network for devices and connect directly to a local MCP endpoint over HTTP, but it does not warn about the security implications of probing the LAN or interacting with live devices. In an agent skill context, this can normalize real-network actions and cause unintended access to or manipulation of physical devices if the user targets the wrong host or if devices are exposed beyond the intended trust boundary.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · rules/use-desktop-acp.md (reported line 30)May include surrounding context.

md

# Install acpx
npm install -g acpx

# Create a session in the current project
acpx --agent 'bricks desktop-acp-bridge' sessions new

# Send a prompt

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The example directly instructs users to run the agent with --approve-all, enabling all tool calls without review. In a headless agent connected to a real project, that can let the model execute shell commands autonomously, increasing the chance of file destruction, secret leakage, dependency tampering, or other unsafe actions from ambiguous or adversarial prompts.

Content

Scanner excerpt · rules/use-desktop-acp.md (reported line 36)May include surrounding context.

md

# Send a prompt
acpx --agent 'bricks desktop-acp-bridge' "list all files and summarize the project"

# Auto-approve all tool calls
acpx --agent 'bricks desktop-acp-bridge' --approve-all "fix the linting errors"

# Quiet mode (final output only)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

This duplicate finding points to the same substantive issue: the documentation normalizes auto-approved command execution in headless ACP mode. Because the agent is project-scoped and can access configured MCP tools, autonomous command execution can compound into broader impact than a simple local shell example.

Content

Scanner excerpt · rules/use-desktop-acp.md (reported line 79)May include surrounding context.

md

- **Settings are shared** — default model and provider config come from the app's settings (credentials are not exposed to the ACP client)
- **MCP is shared** — `.mcp.json` tools configured in the project are available to the ACP agent
- **Project scoped** — the agent operates in the `cwd` passed by the ACP client; the directory must contain `application.json`
- **Auto-approve** — bash commands run without approval in ACP mode (headless); use acpx `--deny-all` to override

## Security Considerations

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

This duplicate finding points to the same substantive issue: the documentation normalizes auto-approved command execution in headless ACP mode. Because the agent is project-scoped and can access configured MCP tools, autonomous command execution can compound into broader impact than a simple local shell example.

Content

Scanner excerpt · rules/use-desktop-acp.md (reported line 79)May include surrounding context.

md

- **Settings are shared** — default model and provider config come from the app's settings (credentials are not exposed to the ACP client)
- **MCP is shared** — `.mcp.json` tools configured in the project are available to the ACP agent
- **Project scoped** — the agent operates in the `cwd` passed by the ACP client; the directory must contain `application.json`
- **Auto-approve** — bash commands run without approval in ACP mode (headless); use acpx `--deny-all` to override

## Security Considerations

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 89% confidence

Finding

This finding is a true risk indicator because the documentation acknowledges that --approve-all allows arbitrary bash execution without confirmation. Although the surrounding text warns against misuse, the capability itself remains dangerous in an agent skill because users may copy-paste commands into real projects where prompt injection, mistakes, or malicious instructions can trigger harmful actions.

Content

Scanner excerpt · rules/use-desktop-acp.md (reported line 83)May include surrounding context.

md

## Security Considerations

- **Prefer `--deny-all` over `--approve-all`:** The `--approve-all` flag permits the agent to run arbitrary bash commands in the project directory without confirmation. Use this only for trusted, well-scoped prompts. For exploratory or untrusted prompts, use `--deny-all` or omit both flags to get interactive approval.
- **Persistent config creates lasting access:** Writing `~/.acpx/config.json` means any process invoking `acpx bricks` can start an ACP session with project file access. Remove the config when not actively using ACP, especially on shared machines.
- **Disable ACP when idle:** Turn off "Enable ACP" in BRICKS Project Desktop Settings when not actively bridging to reduce the attack surface of the local Unix socket.

Static analysis

No suspicious patterns detected.