Security audit
Security checks for vulnerabilities and agentic risk
This package appears to be a real ACP runtime integration, but it grants broad host-level agent control and includes under-scoped automatic repair/install behavior that users should review before installing.
Install only if you trust this package to manage host-level coding-agent sessions. Review the permission mode, native agent enablement, MCP bridge settings, and any configured MCP server environment variables. Be especially cautious with automatic repair behavior, gateway restarts, ~/.acpx/config.json changes, and the unpinned npx adapter paths for kilocode and opencode.
The skill explicitly says not to ask for install permission first unless policy requires it, authorizing package installation and subsequent restart behavior without user consent. In a security context this is a severe violation because it normalizes silent code acquisition and execution on the host, materially increasing supply-chain and unauthorized-change risk.
The trigger conditions are broad enough to match common requests about relaying or continuing work in external coding harnesses, which can cause the skill to activate in more situations than intended. In this skill, over-triggering is risky because activation can lead directly to session spawning, external tool control, and downstream install/repair behavior.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
3. For ACP harness thread creation, do not use `message` with `action=thread-create`; `sessions_spawn` is the only thread-create path.
4. Put requested work in `task` so the ACP session gets it immediately.
5. Set `agentId` explicitly unless ACP default agent is known.
6. Do not ask user to run slash commands or CLI when this path works directly.
Example:
The recovery policy instructs automatic local repair, verification, gateway restart, and retry behavior without a clear warning that the agent may modify the local environment. In practice this can lead to unexpected package changes or service restarts triggered by a normal user request, increasing the chance of unsafe autonomous system modification.
The direct acpx path includes concrete installation and repair commands that modify plugin-local dependencies, but it does not pair them with a clear consent requirement or warning about environment changes. This is dangerous because the skill is not merely descriptive; it is operational guidance for an agent that may execute those steps automatically.
The skill references npx -y @kilocode/cli without a pinned version, so execution may fetch and run whatever package version is current at runtime. In a routing skill that explicitly drives external harnesses and may auto-repair tooling, this creates a supply-chain execution risk and undermines reproducibility.
The unpinned npx -y opencode-ai command allows runtime retrieval and execution of the latest published package, exposing the environment to malicious or compromised upstream releases. Because this skill is designed to route user requests into executable harness sessions, the context makes arbitrary package drift especially dangerous.
Detected: suspicious.dangerous_exec
const child = spawn(command, args, {const child = spawn(target.command, target.args, createTargetSpawnOptions());