ACPX Agent Playbook

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:47 AM UTC
• Version: 1.0.0

Overview

This skill is a delivery playbook for ACPX agents, but it normalizes broad agent permissions and persistent approve-all configuration changes that users should review carefully before use.

Install only if you intentionally want a high-authority ACPX operations playbook. Before following it, prefer read-only or auto modes first, avoid persistent approve-all configuration unless you understand the impact and restore it afterward, confirm exact output paths before shell/Python writes, and pin or verify any packages installed in local virtual environments.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:12

Finding

Broad Full-Access Mode Is Recommended by Default

Content

View full analysis

sessions new --name task acpx set-mode -s task full-access acpx -s task -f prompt.txt ``` The documented meaning of this mode is: ```text - `full-access`: broader session capability, including easier file edits and broader path/network freedom ``` ### Technical Analysis The default workflow grants an ACPX agent broad filesystem and network access for every non-trivial task. This includes tasks that may only require read access or permission to write a single output file. Granting `full-access` before establishing the minimum capabilities required by the task violates the principle of least privilege. The risk is especially significant because the delegated agent processes prompts and potentially attacker-controlled source files. Prompt injection, malicious project content, or an agent error could cause operations outside the intended workspace. Although the documentation correctly states that `full-access` does not imply root or `sudo`, broad user-level filesystem and network access can still expose credentials, configuration files, source code, and other data accessible to the current account. ### Attack Path 1. A user invokes the Skill for a non-trivial artifact or coding task. 2. The documented default workflow places the delegated agent in `full-access` mode. 3. The agent processes attacker-controlled project content, document text, or embedded instructions. 4. Malicious instructions direct the agent to inspect unrelated files, overwrite accessible resources, or contact an external host. 5. The broad session permissions allow these operations even though they are unnecessary for the original task. ### Impact Assessment A ...[truncated 621 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:82

Finding

Global Approve-All Policy Weakens ACPX Permission Controls

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:115

Finding

Shell and Python Fallback Can Circumvent File-Operation Restrictions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:163

Finding

Unpinned Third-Party Package Installation Creates Supply-Chain Risk

Content

View full analysis

Avoid assuming global install rights. Use system-level installs only when explicitly intended and actually permitted by the host. ``` The concrete presentation workflow uses: ```bash python3 -m venv .venv . .venv/bin/activate pip install python-pptx ``` ### Technical Analysis The package installation does not pin a reviewed version, verify package hashes, use a lockfile, or restrict resolution to an approved package index. As a result, the effective dependency and its transitive dependencies can change between executions. A virtual environment limits package installation to the project environment but does not prevent malicious installation hooks, build backends, or imported package code from executing with the permissions of the current user. Ambient `pip` configuration can also redirect installation to an untrusted index. The package name shown is plausible and not evidence of an intentionally malicious dependency. The confirmed issue is the unsafe dependency acquisition process rather than proof that `python-pptx` itself is malicious. ### Attack Path 1. An artifact task requires functionality that is unavailable in the standard library. 2. The agent follows the playbook and runs the unpinned `pip install` command. 3. Package resolution uses the current index configuration and selects the latest matching package and transitive dependencies. 4. A compromised release, package index, resolver configuration, or build dependency supplies malicious code. 5. Malicious installation or import-time code executes with the privileges of ...[truncated 556 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (7)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/ppt-playbook.md (reported line 26)May include surrounding context.

md

- Do not assume global install rights
- If ACP file-edit tools fail, write files through shell heredoc or Python scripts

Output rules:
- Write intermediate files under /tmp
- Final PPTX path: /tmp/output.pptx
- Report path: /tmp/output-report.txt

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill description is very broad and positions the playbook as a default solution for many common agent tasks, including file creation, installs, shell writes, and multi-step work. That scope can cause over-triggering in contexts where high-permission session guidance is unnecessary, increasing the chance an agent will choose a more invasive workflow than the task requires.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This section recommends explicitly setting full-access and describes broader path and network freedom without requiring user confirmation or warning about workspace and host impact. In practice, that guidance can normalize elevated ACPX permissions as a default, making unintended file modification or external network activity more likely.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

- `auto`: moderate default behavior
- `full-access`: broader session capability, including easier file edits and broader path/network freedom

Do **not** assume `full-access` means sudo or root. It relaxes the ACP session; it does not guarantee system-level privilege escalation.

### 4. Use prompt files, not huge shell strings

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill advises shell heredocs, Python-based file writes, /tmp generation, and moving artifacts into final destinations, but it does not require safeguards against overwriting existing files or modifying unintended paths. Because these are direct write strategies that bypass more structured tooling, mistakes or prompt abuse could result in destructive changes to user files.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/provider-compat.md (reported line 13)May include surrounding context.

md

- `acpx claude` is no longer blanket-blocked in this workspace.
- Claude has now passed:
  - fixed-text response
  - minimal file write
  - real PPTX generation and validation
- The key unblocker was **acpx permission configuration**, not prompt wording alone.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/troubleshooting.md (reported line 30)May include surrounding context.

md

## Symptom: generated binary opens inconsistently
Add explicit validation steps before copying the artifact to its final location.

## Symptom: the agent answers text but does not create files
Treat this as a workflow/reliability issue, not proof that the prompt is bad. First rule out provider compatibility, quota problems, acpx permission policy, and command-shape mistakes.

Fast check order:

Static analysis

No suspicious patterns detected.