Security audit

ACPX Runtime

Security checks for vulnerabilities and agentic risk

Overview

This ACP routing plugin is mostly coherent, but it gives external agent runtimes broad host access and includes under-scoped automatic repair and runtime package execution behavior users should review carefully.

Install only if you want OpenClaw to run external coding agents on the Gateway host with their native permissions. Review ACPX repair behavior, adapter command overrides, permissionMode, MCP bridge settings, and any Kilo/OpenCode npx defaults before enabling it in sensitive environments.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · skills/acp-router/SKILL.md (reported line 81)May include surrounding context.
md
3. For ACP harness thread creation, do not use `message` with `action=thread-create`; `sessions_spawn` is the only thread-create path. 4. Put requested work in `task` so the ACP session gets it immediately. 5. Set `agentId` explicitly unless ACP default agent is known. 6. Do not ask user to run slash commands or CLI when this path works directly. Example:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This section authorizes installing packages, repairing binaries, restarting the gateway, and modifying ACPX-related state without a clear up-front user warning or explicit consent boundary. Even if framed as reliability behavior, it allows system-changing actions that could surprise users, alter local environments, or be abused to justify unreviewed package installation and configuration changes.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The skill documents execution of npx -y @kilocode/cli without pinning a version, which can pull the latest package at runtime. That creates a supply-chain risk: behavior may change unexpectedly or a compromised upstream release could be executed during agent operation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The skill references npx -y opencode-ai with no fixed version, allowing execution of whatever package version is current when invoked. In a routing skill that may automatically drive external harnesses, this expands supply-chain exposure and makes behavior non-reproducible.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/.setup/service-De_oVTL3.mjs:608
Evidence: const child = spawn(command, args, {