acp-router
Route plain-language requests for Pi, Claude Code, Codex, OpenCode, Gemini CLI, or ACP harness work into either OpenClaw ACP runtime sessions or direct acpx-dri
Security score
The acp-router skill was audited on Mar 3, 2026 and we found 9 security issues across 2 threat categories, including 3 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 98 | - verify `${ACPX_CMD} --version` |
Template literal with variable interpolation in command context
| 137 | 1. Use `exec` commands that call `${ACPX_CMD}`. |
Template literal with variable interpolation in command context
| 155 | ```bash |
Template literal with variable interpolation in command context
| 164 | ```bash |
Template literal with variable interpolation in command context
| 170 | ```bash |
Template literal with variable interpolation in command context
| 176 | ```bash |
Template literal with variable interpolation in command context
| 214 | - `NO_SESSION`: run `${ACPX_CMD} <agent> sessions new --name <sessionName>` then retry prompt. |
Access to hidden dotfiles in home directory
| 200 | If `~/.acpx/config.json` overrides `agents`, those overrides replace defaults. |
Access to hidden dotfiles in home directory
| 211 | - for thread-spawn ACP requests, first restore built-in defaults by removing broken `~/.acpx/config.json` agent overrides |