ACPX Agent Playbook

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:47 AM UTC
• Version: 1.0.0

Overview

This skill is a delivery playbook for ACPX agents, but it normalizes broad agent permissions and persistent approve-all configuration changes that users should review carefully before use.

Install only if you intentionally want a high-authority ACPX operations playbook. Before following it, prefer read-only or auto modes first, avoid persistent approve-all configuration unless you understand the impact and restore it afterward, confirm exact output paths before shell/Python writes, and pin or verify any packages installed in local virtual environments.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:12
• Finding: Broad Full-Access Mode Is Recommended by Default<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:12-17` **Additional Location**: `SKILL.md:51-62`, `references/ppt-playbook.md:6-10` **Vulnerability Type**: Excessive agent permissions **Risk Level**: High ### Vulnerable Code ```bash Run this default flow for any non-trivial task: acpx <agent> sessions new --name task acpx <agent> set-mode -s task full-access acpx <agent> -s task -f prompt.txt ``` The documented meaning of this mode is: ```text - `full-access`: broader session capability, including easier file edits and broader path/network freedom ``` ### Technical Analysis The default workflow grants an ACPX agent broad filesystem and network access for every non-trivial task. This includes tasks that may only require read access or permission to write a single output file. Granting `full-access` before establishing the minimum capabilities required by the task violates the principle of least privilege. The risk is especially significant because the delegated agent processes prompts and potentially attacker-controlled source files. Prompt injection, malicious project content, or an agent error could cause operations outside the intended workspace. Although the documentation correctly states that `full-access` does not imply root or `sudo`, broad user-level filesystem and network access can still expose credentials, configuration files, source code, and other data accessible to the current account. ### Attack Path 1. A user invokes the Skill for a non-trivial artifact or coding task. 2. The documented default workflow places the delegated agent in `full-access` mode. 3. The agent processes attacker-controlled project content, document text, or embedded instructions. 4. Malicious instructions direct the agent to inspect unrelated files, overwrite accessible resources, or contact an external host. 5. The broad session permissions allow these operations even though they are unnecessary for the original task. ### Impact Assessment A ...[truncated 621 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Default to `read-only`, `auto`, or another constrained session mode. - Determine the required tools, paths, and network destinations before elevating permissions. - Require explicit user confirmation before enabling `full-access`. - Restrict writes to a dedicated workspace or output directory where ACPX supports path scoping. - Disable network access unless the task explicitly requires it. - Use a staged workflow: inspect in read-only mode, request narrowly scoped write access, and elevate further only when a verified operation requires it. - Document how to return the session to its original restricted mode after the task. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:82
• Finding: Global Approve-All Policy Weakens ACPX Permission Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:82-101` **Additional Location**: `references/provider-compat.md:54-65` **Vulnerability Type**: Globally permissive tool authorization **Risk Level**: High ### Vulnerable Code ```json { "defaultPermissions": "approve-reads", "nonInteractivePermissions": "fail" } ``` The Skill presents the following as a working baseline: ```json { "defaultPermissions": "approve-all", "nonInteractivePermissions": "deny" } ``` It then states: ```text Do not assume the failure is prompt quality or provider incompatibility until this is checked. ``` The provider guidance additionally reports: ```text In this workspace, Claude file creation was blocked until `~/.acpx/config.json` was changed from: - `defaultPermissions: "approve-reads"` - `nonInteractivePermissions: "fail"` to: - `defaultPermissions: "approve-all"` - `nonInteractivePermissions: "deny"` ``` ### Technical Analysis The guidance recommends changing the default ACPX policy from approving reads to approving all requested operations. This is a global configuration relaxation rather than a task-specific grant for a designated output path or operation. Because the configuration is stored in `~/.acpx/config.json`, the altered default can affect later sessions and unrelated tasks. A future delegated agent may consequently receive approval for sensitive tool operations without meaningful per-operation review. The `nonInteractivePermissions: "deny"` setting may still reject requests that require non-interactive authorization, but it does not compensate for the broad `defaultPermissions: "approve-all"` policy in contexts where default approval applies. ### Attack Path 1. File creation fails under the restrictive ACPX configuration. 2. The user follows the troubleshooting guidance and changes the global configuration to `defaultPermissions: "approve-all"`. 3. The permissive setting remains active after the original task completes. 4. A ...[truncated 898 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not recommend `approve-all` as a general or persistent baseline. - Use per-session, per-tool, and per-directory grants where supported. - Grant only the specific write operation and destination required for the deliverable. - Require explicit confirmation for terminal execution, network access, and writes outside the designated output directory. - Back up the original ACPX configuration before any temporary change. - Restore the restrictive configuration immediately after the verified operation. - Clearly distinguish diagnostic testing from a recommended production configuration. - Add a verification step that displays the effective permission policy before each delegated session. - Prefer switching to a compatible agent or approved file-writing mechanism rather than globally weakening authorization. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:115
• Finding: Shell and Python Fallback Can Circumvent File-Operation Restrictions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:115-126` **Additional Location**: `references/troubleshooting.md:6-8`, `references/ppt-playbook.md:20-25` **Vulnerability Type**: Security-boundary bypass through an alternate execution channel **Risk Level**: High ### Vulnerable Code ```text ### 7. Prefer shell/Python file writes over ACP fs writes when needed If the task must create or rewrite files, instruct the agent to prefer: - shell heredocs - `python - <<'PY' ... PY` - direct command-line generation Prefer these over tool-native `fs/write_text_file` style edits when prior attempts showed permission failures. Recommended instruction snippet: If built-in file-editing tools fail, write files via shell heredoc or Python scripts instead of ACP fs write calls. ``` The troubleshooting guidance states: ```text ## Symptom: shell `touch` works but ACP file edit fails Likely an ACP handler, permission-control, or cwd sandbox boundary issue. Switch to shell/Python file generation. ``` ### Technical Analysis ACP file APIs may enforce path restrictions, approval checks, or sandbox boundaries that differ from those applied to a terminal tool. Automatically switching to shell or Python after a file operation is denied can circumvent the original control rather than safely resolving the failure. The guidance is particularly risky because it explicitly identifies permission controls and working-directory sandbox boundaries as possible causes, yet recommends another execution channel without requiring the destination, authorization, or boundary to be verified. Shell and Python are general-purpose execution mechanisms. They can write outside the intended directory, overwrite existing files, follow symbolic links, launch subprocesses, and perform operations beyond simple artifact generation. ### Attack Path 1. An agent attempts to write a file using an ACP file API. 2. The API rejects the request because of a permission policy, path restriction ...[truncated 992 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Treat a denied ACP file operation as a security decision until its cause is established. - Do not automatically retry denied writes through shell or Python. - Verify the exact destination and obtain explicit user authorization before using an alternate channel. - Restrict generation to a dedicated directory created with safe ownership and permissions. - Resolve and validate canonical paths before writing, and reject destinations outside the approved root. - Defend against symbolic-link attacks by using safe file-creation flags and checking path components. - Use fixed scripts with validated arguments instead of generating arbitrary shell fragments from prompt content. - Run fallback generators in a sandbox with no network access and minimal filesystem visibility. - Log the denied operation, fallback justification, destination, and validation result. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:163
• Finding: Unpinned Third-Party Package Installation Creates Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:163-173` **Additional Location**: `references/ppt-playbook.md:51-61` **Vulnerability Type**: Unverified and unpinned dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash ### Pattern: local dependency installs If non-stdlib packages are needed, prefer project-local installs: python3 -m venv .venv . .venv/bin/activate pip install <package> Avoid assuming global install rights. Use system-level installs only when explicitly intended and actually permitted by the host. ``` The concrete presentation workflow uses: ```bash python3 -m venv .venv . .venv/bin/activate pip install python-pptx ``` ### Technical Analysis The package installation does not pin a reviewed version, verify package hashes, use a lockfile, or restrict resolution to an approved package index. As a result, the effective dependency and its transitive dependencies can change between executions. A virtual environment limits package installation to the project environment but does not prevent malicious installation hooks, build backends, or imported package code from executing with the permissions of the current user. Ambient `pip` configuration can also redirect installation to an untrusted index. The package name shown is plausible and not evidence of an intentionally malicious dependency. The confirmed issue is the unsafe dependency acquisition process rather than proof that `python-pptx` itself is malicious. ### Attack Path 1. An artifact task requires functionality that is unavailable in the standard library. 2. The agent follows the playbook and runs the unpinned `pip install` command. 3. Package resolution uses the current index configuration and selects the latest matching package and transitive dependencies. 4. A compromised release, package index, resolver configuration, or build dependency supplies malicious code. 5. Malicious installation or import-time code executes with the privileges of ...[truncated 556 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin reviewed direct and transitive dependency versions. - Use a lockfile or requirements file with cryptographic hashes. - Install with hash enforcement, such as `pip install --require-hashes -r requirements.txt`. - Configure an explicitly approved package index instead of relying on ambient resolver configuration. - Review package provenance, maintainers, release history, and build requirements. - Prefer prebuilt, verified wheels where appropriate and avoid unnecessary source builds. - Run dependency installation and artifact generation in an isolated environment with minimal filesystem and network access. - Generate a software bill of materials for reproducible workflows. - Prefer the documented standard-library fallback when package provenance cannot be verified. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (7)

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

- Do not assume global install rights
- If ACP file-edit tools fail, write files through shell heredoc or Python scripts

Output rules:
- Write intermediate files under /tmp
- Final PPTX path: /tmp/output.pptx
- Report path: /tmp/output-report.txt

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill description is very broad and positions the playbook as a default solution for many common agent tasks, including file creation, installs, shell writes, and multi-step work. That scope can cause over-triggering in contexts where high-permission session guidance is unnecessary, increasing the chance an agent will choose a more invasive workflow than the task requires.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This section recommends explicitly setting `full-access` and describes broader path and network freedom without requiring user confirmation or warning about workspace and host impact. In practice, that guidance can normalize elevated ACPX permissions as a default, making unintended file modification or external network activity more likely.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- `auto`: moderate default behavior
- `full-access`: broader session capability, including easier file edits and broader path/network freedom

Do **not** assume `full-access` means sudo or root. It relaxes the ACP session; it does not guarantee system-level privilege escalation.

### 4. Use prompt files, not huge shell strings

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill advises shell heredocs, Python-based file writes, `/tmp` generation, and moving artifacts into final destinations, but it does not require safeguards against overwriting existing files or modifying unintended paths. Because these are direct write strategies that bypass more structured tooling, mistakes or prompt abuse could result in destructive changes to user files.

Session Persistence

Medium

• Category: Rogue Agent

Content

- `acpx claude` is no longer blanket-blocked in this workspace.
- Claude has now passed:
  - fixed-text response
  - minimal file write
  - real PPTX generation and validation
- The key unblocker was **acpx permission configuration**, not prompt wording alone.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Symptom: generated binary opens inconsistently
Add explicit validation steps before copying the artifact to its final location.

## Symptom: the agent answers text but does not create files
Treat this as a workflow/reliability issue, not proof that the prompt is bad. First rule out provider compatibility, quota problems, acpx permission policy, and command-shape mistakes.

Fast check order:

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.