Security audit

ACP Code Agent

Security checks across malware telemetry and agentic risk

Overview

This skill is a real coding-agent orchestrator, but it makes broad persistent OpenClaw security changes and can auto-delegate code access or edits with limited user control.

Review before installing. Use this only for repositories you are comfortable exposing to configured external coding agents, and inspect setup.sh first, especially approve-all permissions, all-session visibility, agent-to-agent access, heartbeat edits, daemon restart, and the global npm install. Prefer manual invocation or tighter triggers for sensitive work.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The README states the skill auto-triggers on a very broad set of common coding phrases, which can cause unintended activation on ordinary requests. In a skill that delegates work to external coding agents, overly broad triggering increases the chance of unreviewed code access, analysis, or modification being initiated without sufficiently explicit user intent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README describes automatic decomposition into multiple agent stages and automatic callback-based progression, but does not clearly warn users that external agents may autonomously inspect or modify code. This reduces informed consent and can lead to unexpected code changes, data exposure to third-party agents, or chained actions continuing without an explicit checkpoint.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger list includes very broad phrases such as 'review', 'fix', 'debug', 'develop', and '看下项目', which can match ordinary conversation and unintentionally invoke a skill that delegates to external coding agents. In this skill's context, accidental invocation is more dangerous because delegated agents may analyze code, modify files, and run tests or commands in a project workspace.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill delegates tasks to external agents that can implement code changes, run tests, and inspect project files, yet the user-facing description does not clearly warn that invoking the skill may cause file modifications or command execution. In this context, lack of disclosure undermines informed consent and raises the risk of users triggering impactful actions they did not expect.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script changes multiple persistent OpenClaw settings, including enabling ACP, setting the backend, default agent, allowed agents, session visibility, and agent-to-agent access, without any explicit confirmation or dry-run preview. In an installer for an agent skill, these changes materially alter trust boundaries and runtime behavior, so silent modification increases the risk of users unknowingly expanding agent capabilities.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script directly rewrites ~/.openclaw/openclaw.json via an inline Node.js script to add heartbeat settings for every configured agent, without prompting the user or creating a backup. Direct file mutation of a user security/runtime config is risky because malformed writes, unexpected schema differences, or unreviewed behavioral changes can affect all future agent sessions.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.destructive_delete_command

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: setup.sh:105

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: README.md:78