Security audit

ACP Orchestrator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a high-impact agent orchestrator whose core behavior is delegated to unpinned npm packages and whose examples launch or terminate agent work without much safety guidance.

Review this skill carefully before installing. Use it only with trusted task files and prompts, avoid running parallel or passthrough commands from untrusted sources, verify the npm package versions you install, and expect invoked agents to have the same file, tool, and credential access as your normal agent environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: manifest.json:14
Finding: Unpinned Executable npm Dependencies Create a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README explicitly promotes batch and parallel execution of task files containing agent commands, but it provides no warning that each line may trigger real agent actions with side effects. In an orchestration skill, this omission is dangerous because users may treat task files as harmless configuration rather than executable instructions, increasing the chance of unintended code changes, data access, or destructive operations across multiple agents at once.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The session spawning, workflow, JSON, and direct passthrough examples normalize launching subagent runs from user-supplied strings without any caution about subprocess-like execution or task injection risk. In this skill's context as an agent orchestrator, these examples make the capability more dangerous because they encourage chaining autonomous execution mechanisms while hiding the operational and security consequences from users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill explicitly documents a process-control command (acpx kill opencode) that can terminate agent sessions, but provides no warning, confirmation requirement, or scope limitations. In an orchestration skill that encourages automation and parallel execution, exposing kill functionality without safety guidance increases the chance of accidental or misuse-driven disruption of active work.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.