ClawHub
Back to skill

Security audit

acpx-faq

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent acpx operations FAQ, but it includes guidance that can route blocked prompts around safety checks while using autonomous child agents with broad write approval.

Review before installing. Use this only in isolated worktrees with clean prompts, minimal credentials, and explicit user approval for any previously blocked content. Avoid copying the classifier-bypass recovery advice into automated workflows, and treat `--approve-all` child-agent runs as able to modify the chosen workspace.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:215
Finding

Instructions Deliberately Route Blocked Content Around Safety Classifiers

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:215-220, SKILL.md:281-282, and SKILL.md:438-439
Vulnerability Type: Safety-classifier evasion through artifact renaming and file-based prompt delivery
Risk Level: High

Complete Relevant Snippets

markdown
- **OpenAI's content filter kills benign turns** that end clean (`[done] end_turn`,
  exit 0). Vocabulary like race / sweep / exploit / attack in a filename, comment or
  prompt triggers it. Read the transcript tail before believing completion; recover by
  re-prompting the same `-s <name>` (context survives unless the reconnect fails -
  acpx then silently falls back to `session/new`) with the artifact renamed
  neutrally and the remaining steps listed explicitly.
markdown
- **Prompt text the driving harness blocks** (a hook or classifier reading a brief
  that mentions gates, secrets or approvals): send every prompt as `-f <file>`.
markdown
- Pass long briefs as `-f <path>` or a path in the prompt, never inlined - inlined
  content in a shell command is what a driving harness's classifier blocks on.

Technical Analysis

The Skill explicitly identifies safety enforcement performed by provider content filters and driving-harness classifiers, then prescribes transformations intended to avoid that enforcement:

  1. Rename an artifact after its filename or content terminology triggers a provider filter.
  2. Move prompt text involving “gates, secrets or approvals” from the inspected inline prompt channel into a file.
  3. Instruct the child agent to consume that file after the driving harness has blocked the equivalent inline content.

Passing large prompts through files can ordinarily be a legitimate robustness technique. Here, however, the stated purpose is specifically that the driving harness classifier blocks the inline content. Similarly, renaming an artifact is explicitly presented as recovery fr ...[truncated 2377 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove all instructions recommending artifact renaming or file-based prompt delivery for the purpose of avoiding a classifier.
  2. Treat any provider or driving-harness safety block as a mandatory stop condition.
  3. Require explicit user review before retrying blocked content, and preserve the original filename and content for auditability.
  4. Permit file-based prompts only for length, quoting, or reliability reasons, and ensure they undergo controls equivalent to inline prompts.
  5. Require sanitization or removal of the material that caused the block before resubmission.
  6. Record the original safety decision, reviewed content, approving user, and sanitized replacement in an audit log.
  7. Default child agents to least privilege. Avoid --approve-all for untrusted or previously blocked briefs, restrict --cwd to an isolated workspace, and expose only the tools needed for the approved task.
  8. Add an explicit rule that repository files, generated briefs, and external artifacts are untrusted data and cannot override user, system, or safety constraints.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CHANGELOG.md (reported line 243)May include surrounding context.

md
- agy: provenance of `agy_acp_server.par` - shipped by the Antigravity install, sha512-verified
  against Google's manifest, never downloaded by acpx or by this skill. Build
  `20260818_01_RC01` is pinned and self-updates nothing. Clears the Socket alert on unverified
  executable provenance.
- agy: Linux / NixOS section - the `--uid=` wrapper, the mandatory `SSL_CERT_FILE` export, and
  installing `agy` by hand rather than piping the installer (its `agy install` step writes to

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

This example explicitly selects an external model/provider (gemini-3.7-flash-medium) and combines it with --approve-all, enabling a remote agent to perform filesystem writes with broad autonomy. In this skill's context, which is about headless orchestration of coding agents, that materially increases the risk of unintended code modification, data exfiltration via generated artifacts, or unsafe execution if operators copy the example without strict directory and credential isolation.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

bash
D=/abs/real/dir                              # must exist: roots resolve through realpath
acpx --agent ~/.local/lib/antigravity-acp/agy_acp_server.par \
     --cwd "$D" --model gemini-3.7-flash-medium --approve-all --timeout 1800 \
     exec "Carry out $D/brief.md. Write your report to $D/report.md."

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

This command creates a session using an external Claude model, enabling work to be routed to a third-party provider under a persistent session context. In a headless agent-orchestration skill, provider selection affects where sensitive prompts, code, and metadata are sent, so using remote models without explicit data-handling constraints can expose proprietary repository contents or credentials present in the working environment.

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

bash
D=/abs/dir
acpx --cwd "$D" --model claude-opus-5 claude sessions ensure --name work
acpx --cwd "$D" claude set effort high -s work                 # optional; after any model change
{ acpx --cwd "$D" --model claude-opus-5 --approve-all --suppress-reads --timeout 2400 \
     claude -s work -f /abs/brief.md && \

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

This example combines a remote Claude model with --approve-all and a file-based prompt, allowing a third-party model to act autonomously on repository contents and write results. In this skill's context, that is more dangerous because the skill is specifically for unattended, headless execution; if copied into production workflows, it can enable broad modifications or leakage of sensitive code with minimal human oversight.

Content

Scanner excerpt · SKILL.md (reported line 235)May include surrounding context.

md
D=/abs/dir
acpx --cwd "$D" --model claude-opus-5 claude sessions ensure --name work
acpx --cwd "$D" claude set effort high -s work                 # optional; after any model change
{ acpx --cwd "$D" --model claude-opus-5 --approve-all --suppress-reads --timeout 2400 \
     claude -s work -f /abs/brief.md && \
  acpx --cwd "$D" claude sessions close work; } >> run.log 2>&1 &
# failed turn (exit 3/5) = close skipped: re-prompt -s work to recover with context,

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

The changelog documents use of --approve-all for the agy recipe, which effectively removes interactive approval barriers for writes. Even though this is operational guidance rather than executable code, a skill that normalizes broad auto-approval increases the chance that a subagent can make unintended or unsafe filesystem changes within the workspace rooted at --cwd. In an agent-launching skill, that context makes the pattern more dangerous because users may adopt the recipe verbatim when dispatching autonomous coding agents.

Content

Scanner excerpt · CHANGELOG.md (reported line 137)May include surrounding context.

md
- **Breaking:** invariant 4 rewritten. Claude permission requests do reach acpx:
  the adapter starts in the Claude settings' `permissions.defaultMode`, and
  `--deny-all` refuses whatever that mode escalates (exit 5). codex's real control is
  its workspace-write sandbox rooted at `--cwd`.
- **Breaking:** the agy recipe now carries `--approve-all` (without it every write is
  refused) and double-quotes the prompt (single quotes passed a literal `$D`).
- agy: the built-in `acpx antigravity` (acpx 0.17.1) needs the `.par` on PATH or a

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md
on it.
4. **Permission flags are not a sandbox.**
   - **claude**: the adapter starts in `permissions.defaultMode` from the Claude
     settings (`acceptEdits` / `auto` approve edits without asking). Only what that
     mode escalates reaches acpx as a permission request - `--deny-all` refuses those
     (exit 5), but an auto-approved edit never asks.
   - **codex**: writes inside its workspace-write sandbox (rooted at `--cwd`, plus temp

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md
- **claude**: the adapter starts in `permissions.defaultMode` from the Claude
     settings (`acceptEdits` / `auto` approve edits without asking). Only what that
     mode escalates reaches acpx as a permission request - `--deny-all` refuses those
     (exit 5), but an auto-approved edit never asks.
   - **codex**: writes inside its workspace-write sandbox (rooted at `--cwd`, plus temp
     dirs) raise no request, so `--deny-all` still writes; outside fails with
     `Operation not permitted`. Network is off unless `config.toml` enables

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md
5. **`[done] end_turn` and exit 0 are not proof of success.** A content-filter kill,
   an MCP load failure, an API error (a 401 during a token refresh, a 400 model
   rejection), or a truncated turn all end that way. Read the stream, or require the
   agent to write a result file you can check. Before a fan-out, one cheap `exec`
   ("Reply OK") per agent and model catches auth and model errors.
6. **A persistent session holds a resident process stack only while it is busy or
   warm.** Every `-s` prompt elects a queue owner holding `npm exec -> node <adapter>

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 27)May include surrounding context.

text
permissions granted by this License.

"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation source, and
configuration files.

"Object" form shall mean any form resulting from mechanical transformation or

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 31)May include surrounding context.

text
permissions granted by this License.

"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation source, and
configuration files.

"Object" form shall mean any form resulting from mechanical transformation or

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 54)May include surrounding context.

text
permissions granted by this License.

"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation source, and
configuration files.

"Object" form shall mean any form resulting from mechanical transformation or

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 147)May include surrounding context.

text
permissions granted by this License.

"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation source, and
configuration files.

"Object" form shall mean any form resulting from mechanical transformation or

Static analysis

No suspicious patterns detected.