TPN Proxy

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:58 PM UTC
• Version: 1.1.2

Overview

The skill mostly matches its proxy purpose, but it asks users to share and persist API keys and includes unsafe payment/API-key examples that need review before installation.

Review this skill before installing. Use a platform secret manager or environment variable for `TPN_API_KEY`; do not paste long-lived API keys into chat or client-side browser code. Be careful with x402 payment examples: verify recipient, network, token, amount, and spending limit before approving any wallet transaction. Only use the skill for public URLs you are comfortable sending through TPN/proxy infrastructure.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:273

Finding

API Key Solicitation and Unspecified Persistent Storage

Content

View full analysis

Once you have the key, share it with me and I'll save it for future sessions. Then I can generate proxies for you anytime. ``` ### Technical Analysis The skill instructs the user to submit a raw TPN API key through the conversational interface and states that the agent will save it for future sessions. This conflicts with the skill's documented security posture, which says that `TPN_API_KEY` is injected by the OpenClaw runtime and only checked for existence. Chat messages, transcripts, telemetry, and agent memory are not appropriate secret-storage mechanisms. The instruction also fails to identify the storage backend, encryption controls, access policy, retention period, deletion procedure, or whether the credential could be exposed to other skills or sessions. Although the project does not contain executable code that implements persistence, the instruction itself directs the agent to perform insecure credential collection and storage. ### Attack Path 1. A user invokes the setup workflow without `TPN_API_KEY` configured. 2. The skill instructs the user to share the API key in the conversation. 3. The user submits the raw credential as a chat message. 4. The key becomes part of conversation history, logs, telemetry, or persistent agent memory. 5. Any actor or component with access to those records can recover the key. 6. The exposed key can be used to authenticate to the TPN API and consume the user's credits or create proxy leases. ### Impact Assessment An exposed API key could permit unauthorized use of the victim's TPN account within the permissions assigned to that key. Likely consequences include credit consumption, unauthorized proxy generation, activity attribution to the victim's account, and loss of account confidentiality. ...[truncated 237 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/x402-examples.md:70

Finding

Unvalidated Server-Controlled Parameters Used to Authorize USDC Spending

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/api-examples.md:64

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:129

Finding

Incomplete SSRF Protection Allows DNS Rebinding and Address-Classification Bypass

Content

View full analysis

` newlines 3. Domain names only — reject raw IP addresses (IPv4 or IPv6) 4. Reject internal hostnames: `*.internal`, `*.local`, `*.localhost`, `*.localdomain`, `*.corp`, `*.lan`, `metadata.*`, single-label hostnames 5. Hostname must resolve via local DNS — reject unresolvable hostnames 6. Resolved IP must be publicly routable — reject `127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `::1`, `fd00::/8`, `169.254.169.254` **Fallback — curl** (only if WebFetch is unavailable). Always double-quote the URL and proxy URI: ```bash curl --proxy "socks5://username:password@ip:port" \ --connect-timeout 10 --max-time 30 \ "https://validated-target-url.com" ``` ``` ### Technical Analysis The protection resolves a hostname during validation and later asks the HTTP client to resolve or use the hostname again. The validated address is not pinned to the connection. This creates a time-of-check/time-of-use condition in which an attacker-controlled domain can return a public address during validation and a prohibited address during the subsequent request. The explicit address list is also incomplete. Examples of omitted non-global IPv6 forms include parts of `fc00::/7` not covered by `fd00::/8`, link-local `fe80::/10`, unspecified `::`, and IPv4-mapped representations. A maintained IP-classification library should be used instead of a partial manual denylist. The preferred `WebFetch` i ...[truncated 2303 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (40)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The aliases include extremely broad triggers like 'proxy' and the description says to activate on phrases such as 'use a proxy' or 'use TPN to open'. That makes accidental invocation likely for ordinary browsing or networking requests, which is risky because the skill routes traffic through third-party proxy infrastructure and may generate credentials or transmit user URLs externally.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs the agent to display full proxy credentials, including username and password, directly to the user. Even if the credentials are short-lived, exposing live secrets in chat increases the chance of leakage through logs, screenshots, shared transcripts, or downstream integrations.

Content

No source excerpt is available for this finding.

Cloud Metadata Access

High

• Category: Server-Side Request Forgery
• Confidence: 90% confidence

Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md

3. Domain names only — reject raw IP addresses (IPv4 or IPv6)
4. Reject internal hostnames: `*.internal`, `*.local`, `*.localhost`, `*.localdomain`, `*.corp`, `*.lan`, `metadata.*`, single-label hostnames
5. Hostname must resolve via local DNS — reject unresolvable hostnames
6. Resolved IP must be publicly routable — reject `127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `::1`, `fd00::/8`, `169.254.169.254`

**Fallback — curl** (only if WebFetch is unavailable). Always double-quote the URL and proxy URI:

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The setup flow tells the user to share their API key with the agent so it can save it for future sessions. Encouraging users to paste long-lived API keys into chat materially increases secret exposure risk via conversation history, logs, memory features, or connectors beyond the intended TPN service.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The browser JavaScript example includes API-key authentication from client-side code, which exposes the API key to end users, browser dev tools, page source, extensions, and network-adjacent contexts. Even if presented as an example, this pattern teaches an unsafe integration that can lead to key theft and unauthorized proxy generation.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/security-assessment.md (reported line 9)May include surrounding context.

md

## 1. Shell Command Construction with User Input

**Concern:** The skill instructs an AI agent to construct shell commands (e.g. `curl`) using values derived from user input — specifically `geo` (country code), `minutes` (duration), `connection_type`, and target URLs. Without validation, a malicious input like `DE"; rm -rf / #` could escape the intended JSON payload and execute arbitrary commands.

**Mitigation:** The skill enforces mandatory input validation before any shell command is constructed:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/security-assessment.md (reported line 9)May include surrounding context.

md

## 1. Shell Command Construction with User Input

**Concern:** The skill instructs an AI agent to construct shell commands (e.g. `curl`) using values derived from user input — specifically `geo` (country code), `minutes` (duration), `connection_type`, and target URLs. Without validation, a malicious input like `DE"; rm -rf / #` could escape the intended JSON payload and execute arbitrary commands.

**Mitigation:** The skill enforces mandatory input validation before any shell command is constructed:

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/security-assessment.md (reported line 9)May include surrounding context.

md

identified in the tpn-proxy skill and explains the mitigations in place.

---

## 1. Shell Command Construction with User Input

**Concern:** The skill instructs an AI agent to construct shell commands (e.g. `curl`) using values derived from user input — specifically `geo` (country code), `minutes` (duration), `connection_type`, and target URLs. Without validation, a malicious input like `DE"; rm -rf / #` could escape the intended JSON payload and execute arbitrary commands.

**Mitigation:** The skill enforces mandatory input validation before any shell command is constructed:

- `geo` — must match exactly 2 uppercase ASCII letters (ISO 3166-1 alpha-2)
- `minutes` — must be a positive integer between 1 and 1440
- `connection_type` — must be one of the enum values `any`, `datacenter`, `residential`
- `format` — must be one of `text` or `json`

The skill explicitly prohibits string concatenation of raw user input into JSON payloads or shell commands. Only validated, type-check

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The security posture states that no other secrets are accessed beyond TPN_API_KEY, yet the x402 flow later assumes access to external payment/signing credentials handled by libraries. This misrepresents the skill’s secret surface and can cause users or platform operators to enable the skill without realizing it may invoke wallet/payment capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The action behavior emphasizes automatically generating proxies and fetching target URLs, but it does not clearly foreground that user-specified destinations will be sent to TPN-managed proxy infrastructure and other external services. This creates a consent and privacy problem, especially for sensitive or internal-looking URLs users may not realize are leaving the default execution environment.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

Before constructing any shell command, **validate every user-provided value**. Never interpolate raw user input into shell commands.

| Input              | Validation rule                                                                                     |
|--------------------|------------------------------------------------------------------------------------------------------|
| `geo`              | Must be exactly 2 uppercase ASCII letters (ISO 3166-1 alpha-2). Reject anything else.                |
| `minutes`          | Must be a positive integer between 1 and 1440. Reject non-numeric or out-of-range values.            |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

Step 3: Generate the proxy

bash

curl -s -X POST https://api.taoprivatenetwork.com/api/v1/proxy/generate \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $TPN_API_KEY" \
  -d '{"minutes": 60, "format": "text", "connection_type": "any"}'

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 75% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.

md

---

The pattern: **the user asks, you act, you return results.** You never tell the user how to call the API — you call it yourself and hand them the output.

---

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest description focuses on making web requests through decentralized SOCKS5 proxies and fetching URLs through a proxy. However, the documented API surface explicitly includes VPN generation endpoints (/vpn/generate, /x402/vpn/generate), which expands the skill into broader VPN provisioning rather than just proxy-mediated web requests.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-examples.md (reported line 9)May include surrounding context.

---

curl

bash

# Generate a proxy (60 min, any country)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

bash

# Generate a proxy (60 min, any country)
RESPONSE=$(curl -s -X POST https://api.taoprivatenetwork.com/api/v1/proxy/generate \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{"minutes": 60, "format": "json", "connection_type": "any"}')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 454)May include surrounding context.

bash

# Generate a proxy (60 min, any country)
RESPONSE=$(curl -s -X POST https://api.taoprivatenetwork.com/api/v1/proxy/generate \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{"minutes": 60, "format": "json", "connection_type": "any"}')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 455)May include surrounding context.

bash

# Generate a proxy (60 min, any country)
RESPONSE=$(curl -s -X POST https://api.taoprivatenetwork.com/api/v1/proxy/generate \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{"minutes": 60, "format": "json", "connection_type": "any"}')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 456)May include surrounding context.

bash

# Generate a proxy (60 min, any country)
RESPONSE=$(curl -s -X POST https://api.taoprivatenetwork.com/api/v1/proxy/generate \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{"minutes": 60, "format": "json", "connection_type": "any"}')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 457)May include surrounding context.

bash

# Generate a proxy (60 min, any country)
RESPONSE=$(curl -s -X POST https://api.taoprivatenetwork.com/api/v1/proxy/generate \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{"minutes": 60, "format": "json", "connection_type": "any"}')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-examples.md (reported line 13)May include surrounding context.

bash

# Generate a proxy (60 min, any country)
RESPONSE=$(curl -s -X POST https://api.taoprivatenetwork.com/api/v1/proxy/generate \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{"minutes": 60, "format": "json", "connection_type": "any"}')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-examples.md (reported line 40)May include surrounding context.

bash

# Generate a proxy (60 min, any country)
RESPONSE=$(curl -s -X POST https://api.taoprivatenetwork.com/api/v1/proxy/generate \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{"minutes": 60, "format": "json", "connection_type": "any"}')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-examples.md (reported line 74)May include surrounding context.

bash

# Generate a proxy (60 min, any country)
RESPONSE=$(curl -s -X POST https://api.taoprivatenetwork.com/api/v1/proxy/generate \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{"minutes": 60, "format": "json", "connection_type": "any"}')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-examples.md (reported line 117)May include surrounding context.

bash

# Generate a proxy (60 min, any country)
RESPONSE=$(curl -s -X POST https://api.taoprivatenetwork.com/api/v1/proxy/generate \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{"minutes": 60, "format": "json", "connection_type": "any"}')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/x402-examples.md (reported line 20)May include surrounding context.

bash

# Generate a proxy (60 min, any country)
RESPONSE=$(curl -s -X POST https://api.taoprivatenetwork.com/api/v1/proxy/generate \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{"minutes": 60, "format": "json", "connection_type": "any"}')

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:168