The aclade-agent npm package runs a daemon that polls a remote server for task objects and executes them with high privileges. These tasks include running arbitrary shell commands, reading and writing arbitrary files, performing recursive directory listings, searching file contents, and scheduling persistent cron jobs. The daemon also auto-updates itself by fetching the latest package version from the npm registry and reinstalling it, enabling automatic execution of any future malicious updates. This design grants the remote server full remote code execution and persistent control over any host running the agent with elevated privileges.