Acp Router

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:41 AM UTC
• Version: 1.0.0

Overview

This routing skill is not clearly malicious, but it gives agents broad runtime repair authority that can install packages, run mutable external adapters, restart the gateway, and change user ACPX configuration.

Install only if you are comfortable letting this skill manage ACP harness routing and recovery. Before use, require explicit approval for npm installs, gateway restarts, and any change to ~/.acpx/config.json, and prefer pinned or locally reviewed adapter binaries instead of floating npx packages.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:109

Finding

Unpinned Third-Party Packages Are Retrieved and Executed Automatically

Content

View full analysis

` 4. Verify before use: - `./extensions/acpx/node_modules/.bin/acpx --version` 5. If install/repair changed ACPX artifacts, restart the gateway and offer to run the restart. 6. Do not run `npm install -g acpx` unless the user explicitly asks for global install. ``` ```markdown ### Built-in adapter commands in acpx Defaults are: - `pi -> npx pi-acp` - `claude -> npx -y @zed-industries/claude-agent-acp` - `codex -> npx @zed-industries/codex-acp` - `opencode -> npx -y opencode-ai acp` - `gemini -> gemini` - `kimi -> kimi acp` If `~/.acpx/config.json` overrides `agents`, those overrides replace defaults. ``` ### Technical Analysis The skill directs the agent to retrieve executable npm packages and immediately run their code. Although the main `acpx` dependency is intended to be resolved from an extension dependency, the adapter commands use `npx` package names without exact versions or integrity verification. Some commands also use `-y`, suppressing installation confirmation. An npm package can execute code through installation lifecycle scripts or through its command-line entry point. Because an unpinned package can change after this skill has been reviewed, the code ultimately executed is ...[truncated 1811 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:133

Finding

Shell Command Injection Through Interpolated Prompts and Paths

Content

View full analysis

-` Where `conversationId` is thread id when available, otherwise channel/conversation id. ### Command templates Persistent session (create if missing, then prompt): ```bash ${ACPX_CMD} codex sessions show oc-codex- \ || ${ACPX_CMD} codex sessions new --name oc-codex- ${ACPX_CMD} codex -s oc-codex- --cwd --format quiet "" ``` One-shot: ```bash ${ACPX_CMD} codex exec --cwd --format quiet "" ``` ``` ### Technical Analysis The templates interpolate several dynamic values into shell command strings: - ``, which can contain arbitrary user-controlled text. - ``, which may contain spaces, quotation marks, substitutions, or shell metacharacters. - ``, which is used without quoting or validation. - The executable, agent, and session values in related templates. Placing a value between double quotation marks is not sufficient shell escaping. POSIX-compatible shells still evaluate command substitutions such as `$(command)` and backticks inside double quotes. A quotation mark supplied in the prompt can also terminate the intended argument and introduce shell control operators. For example, if a prompt is inserted literally as: ```text Review this project $(touch /tmp/inject ...[truncated 1769 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:91

Finding

Automatic Modification of User Configuration and Gateway State Without Prior Approval

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The failure-handling section authorizes removing or altering ~/.acpx/config.json agent overrides to restore defaults, which is a host-level configuration change outside the skill's routing purpose. Modifying user configuration can break custom security controls, redirect execution, or destroy intentional local policy, making this especially dangerous.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs modification/removal of ~/.acpx/config.json, granting host-level configuration mutation unrelated to simple request routing. In context, this can silently override user-chosen agent mappings or safety controls, making the skill capable of changing execution behavior beyond the user's requested task.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are broad enough that ordinary references to external harnesses or continuing prior work could invoke the skill unintentionally. Because this skill contains installation, restart, and direct execution guidance, accidental invocation is more dangerous than it would be for a purely informational router.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

3. For ACP harness thread creation, do not use `message` with `action=thread-create`; `sessions_spawn` is the only thread-create path.
4. Put requested work in `task` so the ACP session gets it immediately.
5. Set `agentId` explicitly unless ACP default agent is known.
6. Do not ask user to run slash commands or CLI when this path works directly.

Example:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs the agent to perform automatic local repair, installation checks, and gateway restart actions, which exceed a routing skill's stated purpose and can materially alter the host environment. This expands the blast radius from request routing into infrastructure modification without an explicit trust boundary or approval step.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs automatic install, config-affecting repair, and restart actions without clear user-facing disclosure of system impact. In context, this can cause privileged-looking environment changes to occur as a side effect of a simple routing request, undermining informed consent and safe operation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The direct acpx path includes package installation, version reconciliation, and restart behavior that is not implied by the manifest's routing-focused description. That mismatch is dangerous because operators may invoke the skill expecting dispatch logic, while the skill can instead modify software state and restart components.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill includes explicit npm install-based package management even though its declared function is routing requests, not administering the system. Allowing package installation from a skill increases the chance of unintended code execution and expands the attack surface through dependency retrieval and install scripts.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill documents adapter defaults that execute remote packages via npx without pinning an exact version, which allows supply-chain drift and potentially unreviewed code execution whenever the adapter is invoked. In this skill's context, those commands are used to control external harnesses, so the behavior is operationally significant rather than merely illustrative.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Using npx -y @zed-industries/claude-agent-acp without an exact version permits execution of whatever package version is current at invocation time. Because this skill routes agent work and may automatically repair/install dependencies, an attacker benefiting from a compromised upstream package could gain code execution in the local environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The documented npx @zed-industries/codex-acp invocation is unpinned, creating a software supply-chain risk through mutable package resolution. In a router skill that may be followed automatically, that risk becomes more dangerous because the skill normalizes direct execution of the resolved package as part of regular workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The npx -y opencode-ai acp adapter is also unpinned, so the effective code executed can change over time or be replaced by a malicious upstream publication. Since the skill encourages fallback into direct adapter-driving flows, the unpinned dependency can directly affect host execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.