ClawHub
Back to skill

Security audit

Acpx

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent ACP automation skill, but it needs review because it documents unattended permission approval and persistent local session/credential storage without enough guardrails.

Use the default or safer approval modes unless you fully trust the repository, agent command, and runtime. Reserve --approve-all for isolated, tightly controlled automation, review what is stored under ~/.acpx, protect any configured credentials, and avoid raw --agent commands unless the target agent is trusted.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill explicitly documents a mode that auto-approves all permission requests, but it does not pair that capability with a clear warning that the agent may then perform writes, deletions, command execution, or other destructive actions without user confirmation. In a headless agent-to-agent CLI, that omission materially increases the chance of unsafe deployment or misuse because operators may enable the flag in automation without understanding the trust boundary.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- `--agent <command>`: raw ACP agent command (escape hatch)
- `--cwd <dir>`: working directory for session scope (default: current directory)
- `--approve-all`: auto-approve all permission requests
- `--approve-reads`: auto-approve reads/searches, prompt for writes (default mode)
- `--deny-all`: deny all permission requests
- `--format <fmt>`: output format (`text`, `json`, `quiet`)
Confidence
84% confidence
Finding
`--approve-all` enables the agent to make autonomous permission decisions for every requested action, removing the human checkpoint that would normally block risky writes or command execution. In this skill's context, which is specifically designed for headless automation and agent orchestration, that autonomy is more dangerous because it is likely to be used non-interactively at scale.

Session Persistence

Medium
Category
Rogue Agent
Content
- `agents` map (`name -> { command }`)
- `auth` map (`authMethodId -> credential`)

Use `acpx config show` to inspect the resolved config and `acpx config init` to create the global template.

## Session behavior
Confidence
80% confidence
Finding
The skill documents persistent storage of session records and turn history under `~/.acpx/sessions/*.json`, which can retain prompts, metadata, and potentially sensitive operational context across runs. In an agent communication tool, that persistence increases exposure to local compromise, accidental leakage, or cross-project data retention if users are not clearly warned about what is stored and how to secure or clear it.

Static analysis

No suspicious patterns detected.