ClawHub
Back to plugin

Security audit

ACPX Runtime

Security checks for vulnerabilities and agentic risk

Overview

This ACP routing skill mostly matches its purpose, but it can make local repair/configuration changes and run some external adapters in ways users should review before installing.

Review this before installing if you do not want OpenClaw to auto-repair ACPX, modify local ACPX adapter config, persist coding-agent session state, or expose local agent sessions through the Pi catalog. Prefer explicit allowed agents, keep permissionMode away from approve-all unless you mean it, and treat kilocode/opencode adapter use as dynamic npm execution unless you configure pinned local commands.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger conditions are broad enough to activate on common user requests about coding tools, external harnesses, or threaded conversations, which may route interactions into higher-risk execution paths unintentionally. In this skill, misrouting is more dangerous than usual because the selected paths can spawn sessions, invoke CLI tooling, and initiate repair/install behavior.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
3. For ACP harness thread creation, do not use `message` with `action=thread-create`; `sessions_spawn` is the only thread-create path.
4. Put requested work in `task` so the ACP session gets it immediately.
5. Set `agentId` explicitly unless ACP default agent is known.
6. Do not ask user to run slash commands or CLI when this path works directly.

Example:
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs the agent to perform local install/repair actions, modify configuration state, and restart the gateway, including language such as not asking for install permission first unless policy requires it. That is a real safety issue because it authorizes impactful system changes without a clear user-facing consent boundary, creating risk of unauthorized environment modification, service disruption, and persistence of unsafe configuration changes.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The skill documents executing `npx -y @kilocode/cli` without a pinned version, which causes the latest package to be fetched and executed at runtime. In a routing skill that can automatically install/repair components and invoke external harness tooling, this creates a real supply-chain risk because a compromised or malicious upstream release could be executed immediately.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The skill references `npx -y opencode-ai` with no version pin, meaning arbitrary future code from the registry may be executed when this adapter path is used. Because this skill is specifically designed to route requests into execution flows and includes automatic recovery behavior, the unpinned package materially increases exposure to supply-chain compromise.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
dist/mcp-proxy.mjs:100
Evidence
const child = spawn(target.command, target.args, createTargetSpawnOptions());

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
dist/service-BAf6nuci.js:907
Evidence
const child = spawn(command, args, {