Security audit

ACPX Runtime

Security checks across malware telemetry and agentic risk

Overview

This ACP router is not clearly malicious, but it can launch external coding agents and perform local repair/config changes with limited user confirmation.

Install this only if you want OpenClaw to launch and manage external coding-agent sessions. Review allowed agents, permissionMode, MCP bridge options, Pi session catalog settings, and ACPX config overrides first; be aware recovery flows may run npm in the plugin directory and alter ACPX agent overrides.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger conditions are broad enough that ordinary requests to use external coding agents or continue prior work could activate this skill without a clear, explicit user opt-in to ACP routing. Because the skill can subsequently execute commands, create sessions, and enter recovery flows that install or modify tooling, ambiguous activation increases the chance of unintended command execution and misrouting into a more privileged workflow.

Missing User Warnings

High

Confidence: 97% confidence
Finding: This section authorizes automatic local repair steps including npm installation, binary verification, gateway restart, and modification or removal of ~/.acpx/config.json overrides, but the skill description does not prominently warn the user about these side effects. In context, this is more dangerous because the skill is a router likely to activate early and then invoke exec-based commands, so a user may unknowingly trigger environment changes and command execution on their system.

VirusTotal

61/61 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/mcp-proxy.mjs:100
Evidence: const child = spawn(target.command, target.args, createTargetSpawnOptions());

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/service-DLjjP2kv.js:954
Evidence: const child = spawn(command, args, {