What the reviewer found
Slash command that scaffolds an ACP package by running the framework's own acp.package-create.sh; the curl | bash points at the author's own acp.install.sh on raw.githubusercontent.com/prmichaelsen and rm -rf acp-{name} removes the directory the command just created. The header directive telling the agent not to deviate, not to argue and that 'this is who you are until you finish reading this document' is coercive boilerplate, but the steps it enforces collect inputs and ask for confirmation before anything runs.
installs-software— installs softwarenetwork— calls the vendor’s APIprompt-injection— tries to steer the agent
What was read
The file as it ships in prmichaelsen/acp-mcp:
agent/commands/acp.package-create.md
What the static scan said
The scan flagged 3things. The reviewer kept 0 and dismissed 3 as false.
SC2Downloads and executes remote code — false positiveRMRecursive force delete — false positiveNETMakes network calls — false positive
How this review was made
Fable 5.1 read the files above on 7 September 2026 and answered three questions: is it dangerous to whoever installs it, is each scanner finding real, and what should the installer know. The verdict is bound to the file's hash; when the file changes, it is scanned afresh and reviewed again. A script that changes while the definition does not is not re-reviewed — that is a known gap. How the scan and the review work.