Security audit

ACPX Runtime

Security checks for vulnerabilities and agentic risk

Overview

The package is a coherent ACP runtime plugin, but it deserves review because its skill instructions allow automatic local repair, package execution, and user configuration changes without clear consent gates.

Install only if you want OpenClaw to manage ACP-backed coding-agent sessions and launch external harness adapters. Before enabling automatic repair or fallback flows, confirm you are comfortable with plugin-local npm installs, unpinned npx adapter defaults for some agents, startup runtime probes, local state persistence, and any changes to ~/.acpx/config.json overrides.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: 3. For ACP harness thread creation, do not use `message` with `action=thread-create`; `sessions_spawn` is the only thread-create path. 4. Put requested work in `task` so the ACP session gets it immediately. 5. Set `agentId` explicitly unless ACP default agent is known. 6. Do not ask user to run slash commands or CLI when this path works directly. Example:
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: This routing skill goes beyond dispatching requests and instructs the agent to install software locally, repair tooling, and restart the gateway, including language like not asking for install permission first unless policy requires it. That expands the skill into autonomous environment modification, which is risky because a prompt-routing component should not be empowered to change local system state or service availability without explicit user authorization.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill documents use of `npx -y @kilocode/cli` without a pinned version, which causes execution of whatever package version is current at runtime. In a security-sensitive routing skill that may invoke external harness tooling automatically, this creates a supply-chain risk: behavior can change unexpectedly or a compromised upstream release could be executed without review.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill references `npx -y opencode-ai` without version pinning, so the executed code is resolved dynamically from the registry at runtime. Because this skill is meant to route and potentially automate execution paths, unpinned remote package execution materially increases supply-chain exposure and makes the environment non-reproducible.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill authorizes modifying `~/.acpx/config.json` to restore defaults by removing user overrides, which is a direct change to user-local configuration unrelated to simple request routing. This can disrupt user intent, erase custom security settings, and create an unsafe precedent where a routing skill silently alters local trust boundaries to make execution succeed.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/.setup/service-DZYyo6-7.mjs:906
Evidence: const child = spawn(command, args, {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/mcp-proxy.mjs:100
Evidence: const child = spawn(target.command, target.args, createTargetSpawnOptions());