The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's built-in agent registry relies on npx to download and execute various third-party packages (e.g., pi-acp, @kilocode/cli, opencode-ai). Several of these commands utilize the -y flag, which bypasses the standard installation confirmation prompt, allowing for silent remote code execution during agent startup.
[COMMAND_EXECUTION]: The skill provides a --agent <cmd> global option, explicitly described as an 'escape hatch' (逃逸口). This allows the AI agent or a script to execute arbitrary shell commands under the guise of an ACP agent, bypassing the predefined registry.
[INDIRECT_PROMPT_INJECTION]: The skill is specifically designed for agent-to-agent communication, creating a significant attack surface for indirect prompt injection.
Ingestion points: The skill processes prompts and structured outputs received from multiple autonomous agents and pipes them into other agents or scripts (SKILL.md).
Boundary markers: No specific delimiters or instructions to ignore embedded commands in agent outputs are documented.
Capability inventory: The skill possesses the ability to execute shell commands, manage files (sessions), and create network sockets/pipes (SKILL.md).
Sanitization: There is no evidence of sanitization or validation of agent-provided data before it is re-injected into the context of other agents or the host system.
[PRIVILEGE_ESCALATION]: The skill includes a --approve-all flag that automatically grants all permission requests from agents. This effectively disables human-in-the-loop oversight for sensitive operations, such as file system modifications or external communications requested by the agents.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the acpx tool itself via npm i -g acpx and uses npx for multiple agent adapters from the NPM registry, introducing supply chain risks from third-party package maintainers.

acpx