Coding Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:42 AM UTC
• Version: 1.0.0

Overview

This coding-delegation skill is mostly coherent, but it normalizes broad unattended agent permissions, unpinned third-party execution, and credential-bearing sessions.

Review before installing. Use this only in isolated workspaces with least-privilege credentials, prefer pinned/preinstalled agent adapters, avoid `--approve-all` and `bypassPermissions` unless you explicitly accept the risk, and do not run unattended background agents on untrusted repositories or with broad private-repo/API access.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned npm Packages Are Downloaded and Executed Dynamically

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:33

Finding

Coding Agents Are Routinely Invoked with Permission Controls Disabled

Content

View full analysis

' ``` ```bash claude --permission-mode bypassPermissions --print \ 'Use jdocmunch to index and explore the docs at . Use search_sections and get_section — do NOT read full doc files. Task: ' ``` ```markdown | CLI | Version | Auth | Notes | |-----|---------|------|-------| | `claude` | 2.1.71 | OAuth | `--print --permission-mode bypassPermissions` | | `codex` | 0.116.0 | OpenAI key (via ~/.bashrc) | `pty:true` required | | `gemini` | 0.29.5 | Gemini API key | `pty:true` recommended | ``` ```bash # With auto-approve acpx --approve-all --cwd ~/project codex exec "Add error handling to the API calls" ``` ```bash acpx --approve-all --no-wait --cwd /tmp/issue-78 codex "Fix issue #78" acpx --approve-all --no-wait --cwd /tmp/issue-99 codex "Fix issue #99" ``` ### Technical Analysis The Skill repeatedly recommends `--approve-all` and `--permission-mode bypassPermissions`. These modes weaken or eliminate interactive authorization boundaries around delegated filesystem, shell, and tool operations. Coding agents commonly process untrusted or partially trusted repository content, including source comments, documentation, test fixtures, build scripts, issue descriptions, and dependency metad ...[truncated 1796 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:168

Finding

Delegated Agent Sessions Are Documented as Having Broad Access to Sensitive API Credentials

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

Prompt pattern:

text

claude --permission-mode bypassPermissions --print \
  'Use jdocmunch to index and explore the docs at <path/repo>.
   Use search_sections and get_section — do NOT read full doc files.
   Task: <your task here>'

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

acpx codex -s backend "refactor the API layer"
acpx codex -s frontend "update the React components"

# Auto-approve permissions
acpx --approve-all codex exec "run and fix failing tests"

# Fire-and-forget (background)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises acpx --approve-all as a normal usage pattern without an accompanying warning that the agent may take unrestricted actions in the target workspace. Because this skill is specifically for autonomous coding delegation, blanket approval materially increases the chance of unsafe edits, secret exposure, or destructive repository actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The skill maps the codex agent to npx @zed-industries/codex-acp without a pinned version, allowing whatever version is current at execution time to be fetched and run. In a delegation skill that encourages broad use of coding agents, this creates supply-chain and reproducibility risk because behavior can silently change or a compromised upstream release could execute with the caller's permissions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The claude registry entry uses npx -y @zed-industries/claude-agent-acp with no version pin, so each invocation may resolve to a different upstream package version. Because this skill is intended to launch autonomous coding agents, unpinned runtime package resolution increases supply-chain exposure and makes security review of the effective code impossible.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

The opencode alias resolves through npx -y opencode-ai acp without a version constraint, which allows arbitrary future package changes to affect executions. In a skill that may grant approval flags and access project files, this is a meaningful supply-chain risk rather than a harmless documentation issue.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 82% confidence

Finding

The pi alias uses npx pi-acp without pinning, exposing users to unreviewed upstream changes whenever the skill launches the provider. Since the skill is designed for repeated autonomous code tasks, that dynamic dependency resolution can enable unexpected code execution or behavior drift.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The fallback command explicitly recommends claude --permission-mode bypassPermissions, which disables normal permission gating for an autonomous coding agent. In the context of this skill, that can allow unrestricted file modification, command execution, and access to workspace content without clear user-facing warning or approval boundaries.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest describes a skill for delegating coding tasks to Codex, Claude Code, or Pi through acpx. The jdocmunch section expands scope into indexing local docs, indexing GitHub repos, and using preconfigured API tokens for summaries and private repos, which are independent documentation-ingestion and external-repo access capabilities not necessary to explain ACP delegation itself.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill goes beyond ACP delegation and documents raw shell/PTy execution and process control primitives, including backgrounding, stdin writes, and key sending. Expanding the operational surface this way weakens the stated safer acpx-first model and gives downstream agents or operators patterns that can be used for less-auditable command execution.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

acpx --cwd ~/project codex exec "Your task" acpx --cwd ~/project claude exec "Your task"

With auto-approve

acpx --approve-all --cwd ~/project codex exec "Add error handling to the API calls"

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

For longer tasks, use persistent sessions or --no-wait:

bash

# Create a named session and start work
cd ~/project
acpx codex sessions new --name myfeature
acpx codex -s myfeature "Build a snake game"

Static analysis

No suspicious patterns detected.