Security audit

ACP Code Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent coding-delegation purpose, but its installer makes broad persistent OpenClaw permission and session-access changes that users should review before installing.

Review setup.sh before installing. Install only if you are comfortable with global ACP delegation settings, automatic permission approval, all-session visibility, agent-to-agent access, heartbeat config edits, daemon restart, and an unpinned global npm install from a mirror. Prefer changing those settings to least-privilege values before use.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: setup.sh:92
Finding: ACP Agents Are Granted Global Session Access and Automatic Permission Approval
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: setup.sh:52
Finding: Unpinned Global Package Installation Uses a Third-Party npm Registry Mirror
Content: View full analysis
/dev/null | grep -q "$PKG"; then info "安装 codex-acp 平台二进制 ($PKG)..." npm install -g "$PKG" --registry=https://registry.npmmirror.com \ && ok "已安装 $PKG" \ || warn "安装失败，codex 可能无法通过 ACP 启动，请手动执行: npm install -g $PKG" ``` ### Technical Analysis The setup script installs a platform-specific npm package globally without specifying an audited version. It also overrides the registry with `https://registry.npmmirror.com`, rather than retrieving the package directly from the canonical npm registry. Because no version is pinned, the installed package can change whenever the script is executed. The effective code therefore depends on the package version and registry response available at installation time, rather than solely on the audited project contents. npm packages can define lifecycle scripts that execute during installation. A malicious package release, compromised registry mirror, compromised publisher account, or mirror inconsistency could consequently introduce arbitrary code execution under the privileges of the user running `setup.sh`. Global installation also increases the affected scope because package files and executable entry points are placed in the global npm environment. The script does not verify a cryptographic checksum, package provenance, signature, lockfile, or expected package version before installation. ### Attack Path 1. An attacker compromises the package publisher, publishes a malicious future version, or compromises the configured registry mirror. 2. The user runs `setup.sh` on a system where the `codex` command is detected and the platform p ...[truncated 1387 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (14)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 78)May include surrounding context.
bash
# 删除 skill rm -rf ~/.openclaw/workspace-assistant/skills/acp-coder openclaw daemon restart

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 78)May include surrounding context.
bash
# 删除 skill rm -rf ~/.openclaw/workspace-assistant/skills/acp-coder openclaw daemon restart

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill is presented as a delegation/orchestration tool, but its instructions also include persistent environment changes such as modifying OpenClaw configuration, enabling plugins, adjusting permission modes, installing global packages, and restarting the daemon. That mismatch is dangerous because users may invoke what appears to be a coding helper without understanding that it can alter local agent infrastructure and reduce security controls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The installation section states that setup.sh will modify OpenClaw configuration, enable cross-session access, install binaries, configure callbacks, and restart the daemon, but it does not present prominent warnings or require informed consent for these system changes. In a skill that orchestrates external agents, silently broadening access or altering daemon behavior materially increases the attack surface and the chance of unsafe deployment.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README describes very broad automatic triggers for coding-related phrases, which can cause this skill to activate on ordinary conversation and delegate user content to external coding agents unexpectedly. In this skill’s context, auto-delegation to external agents increases the risk of unintended code access, data disclosure, or execution of higher-impact workflows without sufficiently explicit user intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list contains broad phrases like review, fix, debug, develop, and 看下项目, which are common in normal conversation and could invoke the skill accidentally. Because this skill can delegate to external agents that analyze code, run tests, and potentially modify files, accidental activation raises the risk of unintended actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description does not clearly warn users that delegated agents may modify project files, run tests, inspect codebases, and execute commands in the target workspace. Missing this disclosure undermines informed consent and can cause users to trigger actions with side effects they did not anticipate.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill claims ACP-only delegation, but the instructions explicitly allow direct local shell execution for some requests. This broadens the execution surface beyond what the user is told to expect and can lead to unintended local command execution under the guise of delegation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script silently changes multiple OpenClaw security-relevant settings in the user's environment without an upfront warning or confirmation. Because it modifies persistent behavior affecting agent permissions and visibility, users may unknowingly end up with a significantly less secure configuration than they intended.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The installer enables permissionMode approve-all, turns on tools.sessions.visibility all, and enables agent-to-agent access globally. These settings materially expand what delegated coding agents can do and what data they can access beyond the narrow purpose of code-task delegation, reducing user oversight and increasing the blast radius if an agent is compromised or misused.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script directly rewrites ~/.openclaw/openclaw.json to add heartbeat settings for all agents, again without explicit user consent or backup handling. Direct file mutation of a user's persistent config can introduce unexpected behavior, break custom configurations, or enable background callback behavior the user did not knowingly authorize.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The uninstall instructions use recursive deletion of the skill directory without warning about the destructive nature of the command or advising users to verify the expanded path. While the target path is specific, destructive shell commands in documentation can still lead to accidental data loss if copied, modified, or run in an unexpected environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The instruction text states in Chinese how the orchestrator must behave, and the document consistently prescribes Chinese reply templates such as "收到，让 claude 去分析这个项目。" without indicating that the assistant should match the user's preferred language. This creates a locale/language policy concern because it implicitly forces one language rather than offering opt-in or adapting to user preference.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The natural-language comments and user-facing messages in the script are presented in Chinese, including the installation description and runtime output. This can amount to a language/locale policy issue if the skill effectively forces a specific language without documenting user opt-in or providing an alternative.
Content: No source excerpt is available for this finding.