ACPX Codex Playbook

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:54 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent acpx/Codex playbook, but it normalizes broad full-access persistent sessions and unpinned package installs without enough scoping or user-control safeguards.

Install only if you are comfortable with a playbook that may encourage agents to use broader filesystem/network access and persistent sessions. Prefer starting acpx sessions in a narrower mode, approve full-access only for a specific need, scope outputs to a known directory, terminate sessions after use, and pin or pre-vet dependencies before package installation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:15

Finding

Excessive Default Use of Full-Access Sessions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:15-20, SKILL.md:35-41, and references/ppt-playbook.md:7-11
Vulnerability Type: Least-privilege violation through unnecessarily broad session permissions
Risk Level: Medium

Complete Code Snippets:

SKILL.md:15-20:

bash

acpx codex sessions new --name task
acpx codex set-mode -s task full-access
acpx codex -s task -f prompt.txt

SKILL.md:35-41:

bash

acpx codex set-mode -s task full-access

text

Interpretation:
- `read-only`: inspect only
- `auto`: moderate default behavior
- `full-access`: broader session capability, including easier file edits and broader path/network freedom

references/ppt-playbook.md:7-11:

bash

acpx codex sessions new --name ppt
acpx codex set-mode -s ppt full-access
acpx codex -s ppt -f prompt.txt

Technical Analysis

The Skill recommends enabling full-access as the default workflow for non-trivial tasks and presentation generation. Its own documentation states that this mode provides broader path and network freedom. Routine document and presentation generation generally only requires access to a dedicated workspace or temporary output directory.

This guidance violates the principle of least privilege because capability is expanded before the task demonstrates a need for it. Although the documentation correctly states that full-access does not imply root or sudo, it can still substantially increase the filesystem and network scope available to task-controlled commands, generated scripts, and imported dependencies.

The issue becomes more significant when the session processes untrusted task content or installs third-party packages. Such content could use the expanded permissions for operations unrelated to the requested deliverable.

Attack Path

1. A user or external task supplies instructions that appear to request a normal report, presentation, or generat ...[truncated 1237 chars]

Remediation

View remediation

Remediation Suggestions

1. Make read-only or auto the default session mode.
2. Use a workspace-scoped write mode for file-generation tasks and restrict output to a dedicated directory.
3. Enable full-access only after a specific required operation fails under the constrained mode.
4. Require explicit user approval before expanding filesystem or network permissions.
5. Disable network access when dependencies are already available or when the task does not require external resources.
6. Run dependency installation and artifact generation with separate, narrowly scoped permissions.
7. Document the exact resources that each workflow requires rather than recommending blanket access.
8. Reset or terminate persistent sessions after task completion to reduce residual exposure.

T08 · Insecure Dependencies

Warning

• Location: references/ppt-playbook.md:45

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: references/ppt-playbook.md:45-52
Vulnerability Type: Unverified and unpinned package installation
Risk Level: Medium

Complete Code Snippet:

bash

python3 -m venv .venv
. .venv/bin/activate
pip install python-pptx

Technical Analysis

The playbook installs python-pptx without an exact version, cryptographic hashes, a lockfile, or a specified trusted package index. A virtual environment limits modification of global Python packages, but it does not verify package integrity or prevent package installation and import hooks from executing code with the permissions of the current session.

Because dependency resolution uses mutable package-index state, the installed package version and transitive dependency set may change over time. Risks include an upstream account or release compromise, a compromised package index or configured mirror, dependency confusion involving transitive packages, and future releases that introduce malicious or vulnerable behavior.

The exposure is amplified by the separate recommendation to run Codex in full-access mode. Installation scripts or imported package code would consequently execute with the filesystem and network access available to that session.

Attack Path

1. A requested presentation requires python-pptx, but the package is not installed locally.
2. The playbook creates and activates a virtual environment.
3. pip install python-pptx queries the configured package index without enforcing a reviewed version or expected hashes.
4. A compromised index, upstream release, mirror, or transitive dependency supplies attacker-controlled code.
5. The malicious code executes during package installation or when the package is imported for presentation generation.
6. The code operates with the permissions of the Codex process and may abuse any broader filesystem or network access granted to the session.

Impact Asse

...[truncated 688 chars]

Remediation

View remediation

Remediation Suggestions

1. Maintain a reviewed requirements or lock file containing exact package and transitive dependency versions.

2. Record and enforce cryptographic hashes with a command such as:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Configure an explicitly approved HTTPS package index and prevent fallback to untrusted mirrors.

4. Download and review dependency artifacts in a controlled environment before making them available to runtime sessions.

5. Prefer an internally mirrored or vendored, integrity-verified dependency set for reproducible generation.

6. Run installation without full-access and with network access limited to the approved package repository.

7. Separate dependency installation from document generation so the generation session can run offline with reduced permissions.

8. Add automated vulnerability, provenance, and package-signature checks where supported.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/ppt-playbook.md (reported line 24)May include surrounding context.

md

- Do not assume global install rights
- If ACP file-edit tools fail, write files through shell heredoc or Python scripts

Output rules:
- Write intermediate files under /tmp
- Final PPTX path: /tmp/output.pptx
- Report path: /tmp/output-report.txt

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill broadly instructs operators to use persistent sessions, file creation/rewrites, local dependency installs, and 'full-access' workflows, but it does not pair those recommendations with a clear user-facing warning about the risks of modifying files, reaching broader paths, or performing network/package operations. In a control-plane skill for an autonomous coding agent, that omission can normalize high-privilege execution and increase the chance of unintended system or data changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The quick-start flow immediately creates a session and sets it to full-access as the default for 'any non-trivial task,' without a nearby caution that this expands file-write and path/network capabilities. Because quick starts are commonly copied verbatim, this can lead users to over-grant privileges for routine tasks and increase the blast radius of mistakes or prompt-induced actions.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

- `auto`: moderate default behavior
- `full-access`: broader session capability, including easier file edits and broader path/network freedom

Do **not** assume `full-access` means sudo or root. It relaxes the ACP session; it does not guarantee system-level privilege escalation.

### 3. Use prompt files, not huge shell strings

Static analysis

No suspicious patterns detected.