Vpn Rotate Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:34 AM UTC
• Version: 0.1.0

Overview

This skill needs Review because it is designed for rate-limit bypass and makes lasting passwordless-sudo VPN and process-control changes that are broader than necessary.

Install only after careful review, preferably in an isolated environment. Do not run the setup script on a shared or important machine unless you accept persistent passwordless sudo changes, plaintext VPN credential storage, and possible disruption of other OpenVPN sessions. Confirm your scraping and geo-access use is authorized by the relevant service and law.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/setup.sh:89

Finding

Unrestricted Passwordless OpenVPN Execution Enables Root Privilege Escalation

Content

View full analysis

/dev/null sudo chmod 440 "$SUDOERS_FILE" echo " ✅ Sudoers configured" fi ``` The manual setup instructions install a similarly unrestricted rule: ```bash echo "$USER ALL=(ALL) NOPASSWD: /usr/sbin/openvpn, /usr/bin/killall" | sudo tee /etc/sudoers.d/openvpn ``` ### Technical Analysis The generated sudoers rule allows the current user to execute `/usr/sbin/openvpn` as any user, including root, without authentication and without restricting its arguments. OpenVPN configuration files can contain directives that load plugins or invoke external helper scripts when script execution is enabled. Because the sudoers rule allows an arbitrary configuration path and arbitrary OpenVPN options, a local user can supply an attacker-controlled configuration rather than one of the intended VPN provider configurations. The unrestricted rule therefore converts OpenVPN into a passwordless root execution mechanism. Limiting the executable path in sudoers does not establish least privilege when the executable accepts configuration-controlled execution hooks. ### Attack Path 1. A user runs `scripts/setup.sh`. 2. The script creates `/etc/sudoers.d/vpn-rotate`. 3. The user receives passwordless permission to invoke OpenVPN with arbitrary arguments. 4. The user creates or obtains an OpenVPN configuration containing privileged command or plugin hooks. 5. The user invokes `/usr/sbin/openvp ...[truncated 532 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/setup.sh:89

Finding

Passwordless kill and killall Permissions Allow Termination of Arbitrary Privileged Processes

Content

View full analysis

/dev/null sudo chmod 440 "$SUDOERS_FILE" echo " ✅ Sudoers configured" fi ``` ### Technical Analysis The sudoers entry grants passwordless access to `/bin/kill` and `/usr/bin/killall` without argument constraints. With `/bin/kill`, an authorized user can supply the PID of an arbitrary process and select signals that terminate, stop, continue, or otherwise affect it. With `/usr/bin/killall`, the user can target all processes matching a selected executable name. These permissions are not restricted to the OpenVPN process launched by this project. The intended operation—stopping one project-owned VPN process—does not require unrestricted control over every process on the system. ### Attack Path 1. A user runs the setup script and receives the generated sudoers permission. 2. The user identifies the PID or executable name of a root-owned service. 3. The user invokes the permitted `kill` or `killall` executable through passwordless sudo. 4. The command sends an attacker-selected signal to the privileged target. 5. The target service is stopped, disrupted, or forced into an unintended state. ### Impact Assessment An attacker could terminate system services, monitoring agents, network controls, VPN processes, or security software. This can cause system-wide denial of service and may facilitate subsequent attacks by disabling protective processes. ...[truncated 210 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/vpn.py:25

Finding

Predictable Files in /tmp Are Used by Privileged OpenVPN Operations

Content

View full analysis

bool: """Disconnect VPN.""" # Kill by PID if PID_FILE.exists(): try: pid = PID_FILE.read_text().strip() self._run(["sudo", "-n", "kill", pid]) PID_FILE.unlink(missing_ok=True) except: pass ``` The setup test also uses a fixed privileged log path: ```bash sudo openvpn --config "$CONFIG" --auth-user-pass "$CREDS_FILE" --daemon --log /tmp/vpn-test.log sleep 10 if ip link show tun0 &>/dev/null; then NEW_IP=$(curl -s --max-time 10 https://api.ipify.org) echo " ✅ Connected! IP: $NEW_IP" # Disconnect sudo killall openvpn 2>/dev/null echo " Disconnected" else echo " ❌ Connection failed" echo " Check /tmp/vpn-test.log for details" exit 1 fi ``` ### Technical Analysis The project uses globally predictable names in `/tmp`, a directory normally writable by all local users. These paths are passed to a root-running OpenVPN process as its PID and log destinations without secure creation, ownership validation, symlink rejection, or per-user isolation. A malicious local user may pre-create a path, replace it, or attempt a race involving a symbolic link. Depending on the target's file-opening behavior and operating-system protections, privileged log creation may overwrite or append to an unintended file. The disconnect implementatio ...[truncated 1386 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/vpn.py:155

Finding

VPN Disconnect Logic Terminates All OpenVPN Processes on the Host

Content

View full analysis

bool: """Disconnect VPN.""" # Kill by PID if PID_FILE.exists(): try: pid = PID_FILE.read_text().strip() self._run(["sudo", "-n", "kill", pid]) PID_FILE.unlink(missing_ok=True) except: pass # Fallback killall self._run(["sudo", "-n", "killall", "openvpn"]) self._current_server = None return True ``` The setup test has the same system-wide behavior: ```bash sudo openvpn --config "$CONFIG" --auth-user-pass "$CREDS_FILE" --daemon --log /tmp/vpn-test.log sleep 10 if ip link show tun0 &>/dev/null; then NEW_IP=$(curl -s --max-time 10 https://api.ipify.org) echo " ✅ Connected! IP: $NEW_IP" # Disconnect sudo killall openvpn 2>/dev/null echo " Disconnected" ``` ### Technical Analysis The disconnect method always executes `killall openvpn`; it is not conditional on failure of the PID-based termination despite being labeled as a fallback. This command targets every process named `openvpn`, including sessions created by other users, services, or administrative tools. VPN software commonly supplies confidentiality and network-routing guarantees. Terminating an unrelated tunnel can unexpectedly return traffic to a non-VPN route. The code does not implement a kill switch or verify that protected traffic remains blocked after termination. ### Attack Path 1. One or more unrelated OpenVPN sessions are active on the host. 2. A user invokes this project's `disconnect`, `rotate`, or setup connection test. 3. The project runs privileged `killall openvpn`. 4. Every matching OpenVPN process is terminated. 5. Unrelated users or applications lose their tunnels and may continue communicating over an unprotecte ...[truncated 373 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (46)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Piping shell output into sudo tee to alter sudoers is a classic chaining pattern because it combines benign-looking shell steps into a privileged persistence mechanism. In the context of a skill already designed for evasion, this materially raises the chance of abuse or unsafe automated execution.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

chmod 600 ~/.vpn/creds.txt

Enable passwordless sudo for openvpn

echo "$USER ALL=(ALL) NOPASSWD: /usr/sbin/openvpn, /usr/bin/killall" | sudo tee /etc/sudoers.d/openvpn

text

## Usage

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The same privileged pipeline appears again in troubleshooting, showing the pattern is an endorsed workflow rather than an isolated example. Recommending a chainable persistence-enabling command as a routine fix makes exploitation easier in agentic or copy-paste execution scenarios.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

Run the setup script or manually add sudoers entry:

bash

echo "$USER ALL=(ALL) NOPASSWD: /usr/sbin/openvpn, /usr/bin/killall" | sudo tee /etc/sudoers.d/openvpn

Connection fails

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/setup.sh (reported line 16)May include surrounding context.

sh

else
    echo "   ❌ OpenVPN not found"
    echo "   Installing..."
    sudo apt update && sudo apt install -y openvpn
    echo "   ✅ OpenVPN installed"
fi
echo

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script persistently modifies /etc/sudoers.d to grant passwordless execution of openvpn, killall, and kill. That broadens privilege without strong necessity for one-time setup and creates a durable privilege boundary weakening that can be abused later by any code running as the user to start privileged VPN processes or terminate processes without authentication.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script changes sudo policy to passwordless execution without a clear warning about the lasting privilege change. Because this alters system trust boundaries beyond normal setup expectations, users may unknowingly authorize a persistent escalation path that other tools or malicious code can later leverage.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

Piping directly into sudo tee writes privileged configuration from shell-expanded user-controlled content into /etc/sudoers.d. Even if $USER is usually benign, this pattern is risky because it combines elevated write capability with insufficiently constrained data flow, and here it results in a persistent passwordless sudo rule.

Content

Scanner excerpt · scripts/setup.sh (reported line 96)May include surrounding context.

sh

echo "   ✅ Sudoers already configured"
else
    echo "   Adding sudoers entry..."
    echo "$USER ALL=(ALL) NOPASSWD: /usr/sbin/openvpn, /usr/bin/killall, /bin/kill" | sudo tee "$SUDOERS_FILE" > /dev/null
    sudo chmod 440 "$SUDOERS_FILE"
    echo "   ✅ Sudoers configured"
fi

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly markets the skill as a way to 'break free from API restrictions' and rotate IPs to avoid blocks while scraping, but provides no warning about terms-of-service violations, account bans, legal restrictions, or unauthorized access risks. Because the stated purpose is to evade rate limits and geo-restrictions, the context makes this substantially more dangerous than a generic VPN automation tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README instructs users to configure passwordless sudo for OpenVPN, which expands privileged execution without warning about system-wide network changes, credential exposure, or the risk of abuse if the script or environment is compromised. In the context of an automation skill meant to rotate IPs for scraping and bypass controls, encouraging silent privileged networking changes is materially dangerous.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

Recommending passwordless sudo for OpenVPN creates a privileged execution path that can be abused to alter routing, DNS, firewall state, or execute unintended actions through scripts that invoke OpenVPN. In this skill's context, where automated rotation is designed to evade service controls, granting unattended root-capable networking operations significantly increases operational and security risk.

Content

Scanner excerpt · README.md (reported line 70)May include surrounding context.

md

- Linux with OpenVPN (`apt install openvpn`)
- VPN account with OpenVPN support
- Passwordless sudo for openvpn (setup script handles this)

## Documentation

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares powerful capabilities in practice—file access, network use, and shell execution—without any explicit tool scope or permission boundaries. That omission increases the chance an agent or user will run setup or networking actions without understanding the full risk surface, especially since the skill also instructs privilege changes and credential storage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is explicitly marketed to bypass API rate limits and geo-restrictions, including high-volume scraping of government APIs. That framing encourages policy evasion and abuse of third-party services, making the context materially more dangerous than a benign privacy or remote-access VPN skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The setup instructions tell users to store VPN credentials locally and enable passwordless sudo, but they do not warn about credential exposure, persistence, or the security implications of modifying sudoers. Users may follow these steps without realizing they are weakening host protections and creating reusable sensitive artifacts on disk.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The setup wizard advertises that it will configure passwordless sudo, which is a privileged system change with meaningful security consequences. Even if intended for convenience, normalizing this behavior without strong guardrails can lower resistance to future abuse and widen the impact of any compromise of the invoking account.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

This will:
- Check OpenVPN is installed
- Help you configure your VPN provider
- Set up passwordless sudo
- Test the connection

### 2. Manual Setup

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

bash

# Install OpenVPN
sudo apt install openvpn

# Create config directory
mkdir -p ~/.vpn/servers

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The skill instructs users to create persistent local directories for VPN configs and store reusable credentials in a predictable location under the home directory. This creates durable sensitive artifacts that may be harvested by other malware, exposed in backups, or reused later without the user's active awareness.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

# Install OpenVPN
sudo apt install openvpn

# Create config directory
mkdir -p ~/.vpn/servers

# Download .ovpn files from your VPN provider

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

# Create credentials file
echo "your_username" > ~/.vpn/creds.txt
echo "your_password" >> ~/.vpn/creds.txt
chmod 600 ~/.vpn/creds.txt

# Enable passwordless sudo for openvpn
echo "$USER ALL=(ALL) NOPASSWD: /usr/sbin/openvpn, /usr/bin/killall" | sudo tee /etc/sudoers.d/openvpn

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 84)May include surrounding context.

sh

# Create credentials file
echo "your_username" > ~/.vpn/creds.txt
echo "your_password" >> ~/.vpn/creds.txt
chmod 600 ~/.vpn/creds.txt

# Enable passwordless sudo for openvpn
echo "$USER ALL=(ALL) NOPASSWD: /usr/sbin/openvpn, /usr/bin/killall" | sudo tee /etc/sudoers.d/openvpn

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The instruction writes a NOPASSWD sudoers rule allowing execution of openvpn and killall without authentication. This weakens privilege boundaries and can be abused for persistence, process manipulation, or as part of a larger local attack chain if the user account or skill execution context is compromised.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

echo "your_password" >> ~/.vpn/creds.txt chmod 600 ~/.vpn/creds.txt

Enable passwordless sudo for openvpn

echo "$USER ALL=(ALL) NOPASSWD: /usr/sbin/openvpn, /usr/bin/killall" | sudo tee /etc/sudoers.d/openvpn

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The sudo tee pipeline creates or overwrites a file in /etc/sudoers.d, directly changing privileged policy from a shell command. This is especially risky in agent-driven contexts because it couples user-controlled shell execution with a persistent authorization change that may not be reviewed carefully.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

chmod 600 ~/.vpn/creds.txt

Enable passwordless sudo for openvpn

echo "$USER ALL=(ALL) NOPASSWD: /usr/sbin/openvpn, /usr/bin/killall" | sudo tee /etc/sudoers.d/openvpn

text

## Usage

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The troubleshooting section repeats the passwordless sudoers modification, reinforcing an unsafe persistent privilege change as the standard fix. Repetition in troubleshooting increases the likelihood that users adopt the insecure configuration even when safer alternatives exist.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

Run the setup script or manually add sudoers entry:

bash

echo "$USER ALL=(ALL) NOPASSWD: /usr/sbin/openvpn, /usr/bin/killall" | sudo tee /etc/sudoers.d/openvpn

Connection fails

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · providers/mullvad.md (reported line 3)May include surrounding context.

md

# Mullvad Setup

## 1. Create Account

Sign up at https://mullvad.net (account number only, no email required)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs users to place VPN credentials in a local plaintext file, which creates credential exposure risk through local compromise, backups, shell history or accidental inclusion in other tooling. Although Mullvad uses an account number rather than a traditional password, the credential still grants access to the VPN service and should be treated as sensitive.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · providers/nordvpn.md (reported line 3)May include surrounding context.

md

# NordVPN Setup

## 1. Create Account

Sign up at https://nordvpn.com

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions explicitly store NordVPN service credentials in a plaintext file on disk using a heredoc. Even though the file is later restricted with chmod 600, plaintext secrets at rest remain recoverable by the account owner, malware running as that user, backups, shell/history mistakes, or accidental disclosure, and the documentation provides no warning or safer alternative.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · providers/mullvad.md (reported line 32)May include surrounding context.

YOUR_SERVICE_USERNAME YOUR_SERVICE_PASSWORD EOF chmod 600 ~/.vpn/creds.txt

text

## 5. Test

Static analysis

No suspicious patterns detected.