The skill disables critical security controls, stores API
Claims to do
Acpx Harness Delegation: 通过 ACP runtime 委托 acpx-enabled harness(Claude Code / Codex 等)的标准协议。
Actually does
This skill uses the `sessions_spawn` function to delegate tasks to external AI models (e.g., Claude, Codex) via an `acp` runtime. It configures the `acpx` tool by checking and setting `ANTHROPIC_API_KEY` in environment variables or `~/.acpx/config.json`, and modifies `~/.acpx/config.json` to set `defaultPermissions` to `approve-all` for automated operation. It also provides commands to manage `acpx` sessions.
openclaw skills install chaoyang78/acp-harness-delegationAccess to sensitive environment variables detected
$ANTHROPIC_API_KEY
The skill instructs configuring `defaultPermissions: "approve-all"` in `~/.acpx/config.json`. This setting disables all interactive security prompts for `acpx` operations, allowing the system to automatically approve any action without user confirmation, which is a severe security misconfiguration.
"defaultPermissions": "approve-all"
The `sessions_spawn` function allows the skill to delegate arbitrary `task` descriptions to various `agentId`s (e.g., Claude, Codex). If the `task` parameter can be influenced by user input, it could lead to attacker-controlled prompts being executed by sub-agents.
sessions_spawn({
runtime: "acp",
agentId: "claude",
task: "任务描述"
})The skill explicitly details how to configure `ANTHROPIC_API_KEY` via environment variables or `authCredentials` within `~/.acpx/config.json`. This makes the skill a potential target for credential theft if compromised, as it identifies the location and usage of sensitive API keys.
ANTHROPIC_API_KEY=sk-...
"authCredentials": {
"ANTHROPIC_API_KEY": "sk-你的key"
}The skill explicitly warns against using `visibility=all` due to 'security risks' and mentions 'CVE-2026-27004 related risks'. This indicates a known vulnerability or dangerous configuration that could be exploited for unauthorized cross-session access or privilege escalation.
// 错误3:visibility=all 有安全风险,不推荐 // → CVE-2026-27004 相关风险
The skill instructs agents to store API keys (ANTHROPIC_API_KEY) in a plaintext config file (~/.acpx/config.json) under authCredentials. This creates a persistent credential storage vulnerability where secrets are written to disk in cleartext, accessible to any process reading the file.
"authCredentials": {
"ANTHROPIC_API_KEY": "sk-你的key"
}The skill instructs configuring 'defaultPermissions: approve-all' in the global acpx config, which silently auto-approves all operations performed by spawned sub-agents without user confirmation. This bypasses human oversight for any action taken by delegated harnesses (Claude Code, Codex, etc.), enabling unconstrained autonomous action.
"defaultPermissions": "approve-all", "nonInteractivePermissions": "deny", "authPolicy": "skip"
The skill's primary function is to spawn sub-agents (Claude Code, Codex, Gemini, Kimi, etc.) via sessions_spawn with arbitrary task descriptions. The task parameter is passed as free-form text, creating a vector for prompt injection where malicious task content could be used to control spawned agent behavior.
sessions_spawn({
runtime: "acp",
agentId: "claude",
mode: "session",
thread: true,
label: "executor",
task: "任务描述"
})The required configuration includes 'authPolicy: skip', which disables authentication policy enforcement in the acpx runtime. This means spawned agents may bypass authentication checks during their operation, potentially allowing escalated access beyond what would normally be permitted.
"authPolicy": "skip"
DeBERTa classifier detected prompt injection (confidence: 0.83)
The skill explicitly frames the approve-all configuration as necessary for 'automated environments' to avoid confirmation dialogs. This social engineering of the operator/user normalizes disabling human-in-the-loop controls, framing approval prompts as friction rather than a security feature.
这个配置让 acpx 在自动化环境下自动批准所有操作,不弹确认框。
The skill defines very broad trigger conditions including common phrases like 'spawn acpx harness' and 'delegation to claude/codex'. These triggers are easily satisfied by normal user requests or by injected content in processed data, lowering the bar for unintended activation of sub-agent spawning.
- "spawn acpx harness" - "用 acp 调用外部 agent" - "通过 ACP 委托 harness"
The skill promotes fixed-label session reuse ('label: executor') which persists context for 30 days with a 500-message history. This means context from one task bleeds into subsequent tasks via the same session, creating a persistent memory channel that could be exploited to poison future agent reasoning through carefully crafted prior interactions.
使用固定 `label` 的好处: - 第一次调用:创建 session - 后续调用:自动 reconnect 到已有 session,保留上下文 - Session 有 30 天归档清理 + 500 条上限
The skill references 'CVE-2026-27004' to discourage use of visibility=all, lending false authority to its recommendations. A CVE dated 2026 is suspicious (future-dated at time of analysis) and may be fabricated to manipulate agent/operator reasoning toward the skill's preferred (less visible, less auditable) configuration.
// → CVE-2026-27004 相关风险
[](https://mondoo.com/ai-agent-security/skills/clawhub/chaoyang78/acp-harness-delegation)<a href="https://mondoo.com/ai-agent-security/skills/clawhub/chaoyang78/acp-harness-delegation"><img src="https://mondoo.com/ai-agent-security/api/badge/clawhub/chaoyang78/acp-harness-delegation.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/clawhub/chaoyang78/acp-harness-delegation.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.