Security audit

tox-tunnel-ops

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent for managing ToxTunnel, but it can steer an agent into privileged remote installs and persistent services with some unsafe scoping choices.

Install only if you are comfortable with an agent helping configure remote network access and potentially running root/Administrator install commands. Keep execution manual: pin versions, verify any available digest, do not let a mutable README override reviewed instructions, inspect installers before running them, and explicitly decide whether systemd/launchd/SCM persistence should be enabled.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: references/execute.md:78
Finding: Privileged Execution of Remotely Retrieved Installer Scripts
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/execute.md:35
Finding: Privileged Installation of Packages Without Enforced Independent Integrity Verification
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Warning

Location: references/execute.md:136
Finding: Preferred Package Installation Can Enable Persistent Services Without Explicit Persistence Consent
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: references/execute.md:20
Finding: Mutable External README Is Granted Precedence Over Audited Installation Instructions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (107)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 342)May include surrounding context.
md
> `scripts/diagnose.sh` checks all four; run it after writing a rules file.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 425)May include surrounding context.
md
> `scripts/diagnose.sh` checks all four; run it after writing a rules file.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 785)May include surrounding context.
md
> `scripts/diagnose.sh` checks all four; run it after writing a rules file.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 798)May include surrounding context.
md
> `scripts/diagnose.sh` checks all four; run it after writing a rules file.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 892)May include surrounding context.
md
> `scripts/diagnose.sh` checks all four; run it after writing a rules file.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 913)May include surrounding context.
md
> `scripts/diagnose.sh` checks all four; run it after writing a rules file.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 970)May include surrounding context.
md
> `scripts/diagnose.sh` checks all four; run it after writing a rules file.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 982)May include surrounding context.
md
> `scripts/diagnose.sh` checks all four; run it after writing a rules file.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · examples/local-loopback-test.md (reported line 127)May include surrounding context.
md
user@127.0.0.1 'whoami; uname -s' # Web (status + large-file integrity): curl --noproxy '*' -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:13080/ curl --noproxy '*' -s http://127.0.0.1:13080/big.bin | shasum -a 256 # compare to source # Postgres (real query):

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · SKILL.md (reported line 327)May include surrounding context.
md
**Silent-widening bugs (these are the dangerous ones):** - **Unrecognised keys inside an allow/deny entry.** Only `host` and `ports` are read; anything else is ignored with no warning. - **A missing `ports` key**, which the engine reads as **all ports**. Together with the previous item, a `port: 22` typo (singular) parses as "allow every port on that host". Confirmed on v0.4.12: the daemon logs `Loaded access rules`

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · references/diagnose.md (reported line 95)May include surrounding context.
md
**Silent-widening bugs (these are the dangerous ones):** - **Unrecognised keys inside an allow/deny entry.** Only `host` and `ports` are read; anything else is ignored with no warning. - **A missing `ports` key**, which the engine reads as **all ports**. Together with the previous item, a `port: 22` typo (singular) parses as "allow every port on that host". Confirmed on v0.4.12: the daemon logs `Loaded access rules`

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 1041)May include surrounding context.
service.allow_client_daemon: true.

If the user explicitly wants this path, pin it to a release tag, download it, let them read it, and only then run it. master is mutable: the | sudo sh form executes whatever landed on that branch today, as root, unreviewed.

bash

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · references/execute.md (reported line 85)May include surrounding context.
service.allow_client_daemon: true.

If the user explicitly wants this path, pin it to a release tag, download it, let them read it, and only then run it. master is mutable: the | sudo sh form executes whatever landed on that branch today, as root, unreviewed.

bash

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · references/execute.md (reported line 109)May include surrounding context.
service.allow_client_daemon: true.

If the user explicitly wants this path, pin it to a release tag, download it, let them read it, and only then run it. master is mutable: the | sudo sh form executes whatever landed on that branch today, as root, unreviewed.

bash

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · references/execute.md (reported line 109)May include surrounding context.
md
user-customized config (only rewrites the freshly seeded server template when switching to client). Do not run the `curl … | sudo sh` or `irm … | iex` form on the user's behalf. #### Unpinned `-latest` aliases (convenience only)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · references/execute.md (reported line 109)May include surrounding context.
md
user-customized config (only rewrites the freshly seeded server template when switching to client). Do not run the `curl ... | sudo sh` or `irm ... | iex` form on the user's behalf. #### Unpinned `-latest` aliases (convenience only)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 87% confidence
Finding: This one-liner chains a mutable remote download directly into privileged installation using && sudo, encouraging operators to skip inspection and verification. In a tunneling/VPN skill, compromise would grant an attacker persistent privileged foothold on a machine likely intended for remote access, amplifying the blast radius.
Content: Scanner excerpt · references/execute.md (reported line 119)May include surrounding context.
bash
ARCH=x86_64 # or aarch64 (Darwin: arm64 / x86_64) BASE=https://github.com/agentx-icu/tox-tcp-tunnel/releases/latest/download wget "$BASE/toxtunnel-Linux-${ARCH}-latest.deb" && sudo dpkg -i "toxtunnel-Linux-${ARCH}-latest.deb" wget "$BASE/toxtunnel-Linux-${ARCH}-latest.rpm" && sudo rpm -i "toxtunnel-Linux-${ARCH}-latest.rpm" wget "$BASE/toxtunnel-Darwin-${ARCH}-latest.pkg" && sudo installer -pkg "toxtunnel-Darwin-${ARCH}-latest.pkg" -target / # Windows: $BASE/toxtunnel-Windows-AMD64-latest.msi (ARM64 variant available), run as Administrator

Chaining Abuse

High

Category: Tool Misuse
Confidence: 87% confidence
Finding: The RPM example similarly chains download success directly to privileged execution. This reduces operator scrutiny and turns a repository compromise into immediate root-level code execution.
Content: Scanner excerpt · references/execute.md (reported line 120)May include surrounding context.
ARCH=x86_64 # or aarch64 (Darwin: arm64 / x86_64) BASE=https://github.com/agentx-icu/tox-tcp-tunnel/releases/latest/download wget "$BASE/toxtunnel-Linux-${ARCH}-latest.deb" && sudo dpkg -i "toxtunnel-Linux-${ARCH}-latest.deb" wget "$BASE/toxtunnel-Linux-${ARCH}-latest.rpm" && sudo rpm -i "toxtunnel-Linux-${ARCH}-latest.rpm" wget "$BASE/toxtunnel-Darwin-${ARCH}-latest.pkg" && sudo installer -pkg "toxtunnel-Darwin-${ARCH}-latest.pkg" -target /

Windows: $BASE/toxtunnel-Windows-AMD64-latest.msi (ARM64 variant available), run as Administrator

text

Chaining Abuse

High

Category: Tool Misuse
Confidence: 86% confidence
Finding: The macOS convenience one-liner chains a mutable download to sudo installer, which executes package scripts as administrator. The chaining pattern makes risky behavior easy to copy-paste without pause or verification.
Content: Scanner excerpt · references/execute.md (reported line 121)May include surrounding context.
BASE=https://github.com/agentx-icu/tox-tcp-tunnel/releases/latest/download wget "$BASE/toxtunnel-Linux-${ARCH}-latest.deb" && sudo dpkg -i "toxtunnel-Linux-${ARCH}-latest.deb" wget "$BASE/toxtunnel-Linux-${ARCH}-latest.rpm" && sudo rpm -i "toxtunnel-Linux-${ARCH}-latest.rpm" wget "$BASE/toxtunnel-Darwin-${ARCH}-latest.pkg" && sudo installer -pkg "toxtunnel-Darwin-${ARCH}-latest.pkg" -target /

Windows: $BASE/toxtunnel-Windows-AMD64-latest.msi (ARM64 variant available), run as Administrator

text

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · references/execute.md (reported line 127)May include surrounding context.
md
#### Build from source (only if no package fits) - macOS: `brew install libsodium && cd <project> && cmake -B build -DCMAKE_BUILD_TYPE=Release && cmake --build build -j$(sysctl -n hw.ncpu) && sudo cp build/toxtunnel /usr/local/bin/` - Linux (Debian/Ubuntu): `sudo apt install libsodium-dev build-essential cmake && cd <project> && cmake -B build -DCMAKE_BUILD_TYPE=Release && cmake --build build -j$(nproc) && sudo cp build/toxtunnel /usr/local/bin/` - Linux (Fedora/RHEL): `sudo dnf install libsodium-devel cmake gcc-c++ && ...` - Windows: build with MSVC + vcpkg or MSYS2 (see `BUILDING.md`)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · references/execute.md (reported line 128)May include surrounding context.
md
#### Build from source (only if no package fits) - macOS: `brew install libsodium && cd <project> && cmake -B build -DCMAKE_BUILD_TYPE=Release && cmake --build build -j$(sysctl -n hw.ncpu) && sudo cp build/toxtunnel /usr/local/bin/` - Linux (Debian/Ubuntu): `sudo apt install libsodium-dev build-essential cmake && cd <project> && cmake -B build -DCMAKE_BUILD_TYPE=Release && cmake --build build -j$(nproc) && sudo cp build/toxtunnel /usr/local/bin/` - Linux (Fedora/RHEL): `sudo dnf install libsodium-devel cmake gcc-c++ && ...` - Windows: build with MSVC + vcpkg or MSYS2 (see `BUILDING.md`)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · references/execute.md (reported line 313)May include surrounding context.
md
#### Build from source (only if no package fits) - macOS: `brew install libsodium && cd <project> && cmake -B build -DCMAKE_BUILD_TYPE=Release && cmake --build build -j$(sysctl -n hw.ncpu) && sudo cp build/toxtunnel /usr/local/bin/` - Linux (Debian/Ubuntu): `sudo apt install libsodium-dev build-essential cmake && cd <project> && cmake -B build -DCMAKE_BUILD_TYPE=Release && cmake --build build -j$(nproc) && sudo cp build/toxtunnel /usr/local/bin/` - Linux (Fedora/RHEL): `sudo dnf install libsodium-devel cmake gcc-c++ && ...` - Windows: build with MSVC + vcpkg or MSYS2 (see `BUILDING.md`)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to generate, validate, and in Execute/Diagnose modes run shell commands, but it declares no tool restrictions such as allowed-tools or permissions. In an agent environment, that mismatch is dangerous because a user can trigger shell-capable behavior without an explicit capability boundary, increasing the chance of unintended command execution on the host.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 81% confidence
Finding: The skill includes detailed OS-specific instructions noting that macOS/Linux package installs bootstrap launchd/systemd services automatically. Because the skill also supports Execute mode, these instructions materially increase the risk that an agent causes unintended persistence contrary to user expectations.
Content: Scanner excerpt · SKILL.md (reported line 994)May include surrounding context.
md
3. **Minimum privilege by default.** When generating rules.yaml, only allow the exact host:port combinations needed. Each friend gets their own rule entry with explicit 64-char hex public key. 4. **No friend wildcards.** The `friend` field in rules.yaml must be an exact 64-character hex public key. Never use `*` for friend identity. 5. **OS-aware.** Detect or ask the user's OS and tailor paths, commands, and service management: - macOS (package): `binary: /usr/local/bin/toxtunnel`; example config at `/usr/local/share/toxtunnel/config.yaml.example`. The pkg postinstall **automatically** seeds `/usr/local/etc/toxtunnel/config.yaml` from the example, installs `com.toxtunnel.daemon.plist` into `/Library/LaunchDaemons/`, and runs `launchctl bootstrap`. The daemon then honours `service.allow_client_daemon` / `service.auto_start` and exits 0 cleanly when gated off. - Linux (package): `binary: /usr/bin/toxtunnel`, `config: /etc/toxtunnel/config.yaml`, `data: /var/lib/toxtunnel`, service: `toxtunnel.service` (`Type=notify`, `RemainAfterExit=yes`). The postinst seeds the config from the example and runs `systemctl enable --now`. Server installs come up online; client installs idle (`active (exited)`) until the user fills in `client.server_id` and sets `service.allow_client_daemon: true`. - Windows (package): `binary: C:\Program Files\ToxTunnel\bin\toxtunnel.exe`. **The MSI does NOT auto-register the SCM service** (the WiX patch is shelved in `cmake/Packaging.cmake` until the correct CPack-generated component Id is discovered). Workflow: user runs the MSI, creates `C:\ProgramData\ToxTunnel\config.yaml`, then registers the service explicitly: `& 'C:\Program Files\ToxTunnel\bin\toxtunnel.exe' install-windows-service -c 'C:\ProgramData\ToxTunnel\config.yaml'`, then `sc start ToxTunnel`. The repo's own `scripts/install.ps1` (in the tox-tcp-tunnel repository, not this skill's `scripts/`) does all of this automatically (download → install → seed config → start service) base ...[truncated 25 chars]

Session Persistence

Medium

Category: Rogue Agent
Confidence: 83% confidence
Finding: The skill documents package behavior that automatically enables and starts a persistent service (systemctl enable --now) during install. In agentic contexts, session persistence is sensitive because installing a package could silently create a long-lived background daemon even though the skill's own policy says not to enable persistence without explicit request.
Content: Scanner excerpt · SKILL.md (reported line 995)May include surrounding context.
md
4. **No friend wildcards.** The `friend` field in rules.yaml must be an exact 64-character hex public key. Never use `*` for friend identity. 5. **OS-aware.** Detect or ask the user's OS and tailor paths, commands, and service management: - macOS (package): `binary: /usr/local/bin/toxtunnel`; example config at `/usr/local/share/toxtunnel/config.yaml.example`. The pkg postinstall **automatically** seeds `/usr/local/etc/toxtunnel/config.yaml` from the example, installs `com.toxtunnel.daemon.plist` into `/Library/LaunchDaemons/`, and runs `launchctl bootstrap`. The daemon then honours `service.allow_client_daemon` / `service.auto_start` and exits 0 cleanly when gated off. - Linux (package): `binary: /usr/bin/toxtunnel`, `config: /etc/toxtunnel/config.yaml`, `data: /var/lib/toxtunnel`, service: `toxtunnel.service` (`Type=notify`, `RemainAfterExit=yes`). The postinst seeds the config from the example and runs `systemctl enable --now`. Server installs come up online; client installs idle (`active (exited)`) until the user fills in `client.server_id` and sets `service.allow_client_daemon: true`. - Windows (package): `binary: C:\Program Files\ToxTunnel\bin\toxtunnel.exe`. **The MSI does NOT auto-register the SCM service** (the WiX patch is shelved in `cmake/Packaging.cmake` until the correct CPack-generated component Id is discovered). Workflow: user runs the MSI, creates `C:\ProgramData\ToxTunnel\config.yaml`, then registers the service explicitly: `& 'C:\Program Files\ToxTunnel\bin\toxtunnel.exe' install-windows-service -c 'C:\ProgramData\ToxTunnel\config.yaml'`, then `sc start ToxTunnel`. The repo's own `scripts/install.ps1` (in the tox-tcp-tunnel repository, not this skill's `scripts/`) does all of this automatically (download → install → seed config → start service) based on `--Mode` — download and review it before running, see General Rule 6. Removal: `uninstall-windows-service`. Upgrading in place (`msiexec /i new.msi /qn`) keeps the config, `data\` and the ...[truncated 25 chars]

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T08 · Insecure Dependencies

T06 · System Persistence

T01 · Skill Instruction Hijacking

SkillSpector

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

External Script Fetching

Anti-Refusal Statement

Anti-Refusal Statement

Chaining Abuse

Chaining Abuse

Chaining Abuse

External Script Fetching

External Script Fetching

Chaining Abuse

Chaining Abuse

Windows: $BASE/toxtunnel-Windows-AMD64-latest.msi (ARM64 variant available), run as Administrator

Chaining Abuse

Windows: $BASE/toxtunnel-Windows-AMD64-latest.msi (ARM64 variant available), run as Administrator

Chaining Abuse

Chaining Abuse

Chaining Abuse

Undeclared Tool Scope

Session Persistence

Session Persistence

Static analysis