tox-tunnel-ops

• Outcome: Review
• Latest audit: Aug 30, 2026 · 3:26 PM UTC
• Version: 0.4.13

Overview

This skill is a coherent ToxTunnel operations guide, but its recommended install and service paths can make privileged, persistent remote-access changes too easily.

Install only if you are comfortable reviewing high-impact remote-access setup steps. Prefer pinned release packages or downloaded installers with checksum/signature verification over the pipe-to-shell commands, and explicitly decide whether you want a persistent service before running any installer that enables systemd, launchd, or Windows SCM. Keep rules limited to exact friend keys and exact host:port targets, and back up tox_save.dat before any diagnostic reset.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no permissions while explicitly instructing the agent to perform network-facing and shell-capable actions such as installing software, starting daemons, editing configs, and invoking local scripts. That mismatch weakens policy enforcement and user transparency, making it easier for a caller to trigger impactful operations without an accurate declared capability boundary.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document instructs users how to grant temporary access to internal databases to contractors, but it does not prominently warn that this can expose sensitive production or internal data and should only be used with strict least-privilege controls. In this context, the omission matters because the skill lowers the barrier to exposing high-value services, and readers may apply it to production systems without understanding the data handling and access governance risks.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation recommends `rm -rf <data_dir>/tox_save.dat` as recovery for a corrupt or mis-typed save file, but the command deletes persistent identity state and can cause loss of trust relationships or require re-pairing. In an ops runbook, destructive steps are especially risky because stressed operators may copy-paste them without understanding the consequences.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The guidance recommends deleting the entire client `data_dir` to recover from a deadlocked friendship state, which irreversibly destroys the client's identity and all persisted state. Because this is a remote-access tunneling tool, wiping the whole state directory can break access control mappings, invalidate established trust, and create operational or security confusion if operators regenerate identities carelessly.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The document recommends piping a remotely fetched script directly into `sudo sh`/`iex`, which gives immediate elevated code execution to whatever content is served at that URL at runtime. Because this skill is specifically about remote network access and service deployment, the install path meaningfully increases risk: a compromised GitHub account, repository, branch, CDN path, or MITM in a misconfigured environment could lead to full host compromise and persistence.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- Windows (package): `binary: C:\Program Files\ToxTunnel\bin\toxtunnel.exe`. **The MSI does NOT auto-register the SCM service** (the WiX patch is shelved in `cmake/Packaging.cmake` until the correct CPack-generated component Id is discovered). Workflow: user runs the MSI, creates `C:\ProgramData\ToxTunnel\config.yaml`, then registers the service explicitly: `& 'C:\Program Files\ToxTunnel\bin\toxtunnel.exe' install-windows-service -c 'C:\ProgramData\ToxTunnel\config.yaml'`, then `sc start ToxTunnel`. The bundled `scripts/install.ps1` one-liner does all of this automatically (download → install → seed config → start service) based on `--Mode`. Removal: `uninstall-windows-service`. Upgrading in place (`msiexec /i new.msi /qn`) keeps the config, `data\` and the registered service; stop the service first and start it again afterwards. **Do not launch a second daemon from an SSH session** (`Start-Process` inside `ssh win "..."`): Win32-OpenSSH tears the session's job object down when the command returns and the daemon dies silently (no log line). Use the service, a Scheduled Task, or `Invoke-CimMethod -ClassName Win32_Process -MethodName Create`.
   - For manual installs, use home-directory paths as before.
6. **Prefer the one-line installer, then native packages, then source.** Recommend the one-liner first (it auto-detects arch + package format and seeds a mode-appropriate config):
   - macOS/Linux: `curl -fsSL https://raw.githubusercontent.com/agentx-icu/tox-tcp-tunnel/master/scripts/install.sh | sudo sh -s -- --mode {server|client}`
   - Windows (Administrator PowerShell): `$env:TOXTUNNEL_MODE='{server|client}'; irm https://raw.githubusercontent.com/agentx-icu/tox-tcp-tunnel/master/scripts/install.ps1 | iex`
   Fall back to direct DEB/RPM/.pkg/MSI download from GitHub Releases when the user can't pipe to sh/iex (locked-down environments). Only suggest building from source when no pre-built package exists for the target platform.
7. **Safe defaults.** `tox.bootstrap_mo
...[truncated 25 chars]

• Confidence: 90% confidence
• Finding: The skill recommends privileged execution paths, including piping a remotely fetched installer into `sudo sh`, and also includes Windows administrative installation flows. In an agent context, normalizing privileged execution substantially increases the blast radius of prompt abuse, repository compromise, or accidental command execution.

Session Persistence

Medium

• Category: Rogue Agent

Content

4. **No friend wildcards.** The `friend` field in rules.yaml must be an exact 64-character hex public key. Never use `*` for friend identity.
5. **OS-aware.** Detect or ask the user's OS and tailor paths, commands, and service management:
   - macOS (package): `binary: /usr/local/bin/toxtunnel`; example config at `/usr/local/share/toxtunnel/config.yaml.example`. The pkg postinstall **automatically** seeds `/usr/local/etc/toxtunnel/config.yaml` from the example, installs `com.toxtunnel.daemon.plist` into `/Library/LaunchDaemons/`, and runs `launchctl bootstrap`. The daemon then honours `service.allow_client_daemon` / `service.auto_start` and exits 0 cleanly when gated off.
   - Linux (package): `binary: /usr/bin/toxtunnel`, `config: /etc/toxtunnel/config.yaml`, `data: /var/lib/toxtunnel`, service: `toxtunnel.service` (`Type=notify`, `RemainAfterExit=yes`). The postinst seeds the config from the example and runs `systemctl enable --now`. Server installs come up online; client installs idle (`active (exited)`) until the user fills in `client.server_id` and sets `service.allow_client_daemon: true`.
   - Windows (package): `binary: C:\Program Files\ToxTunnel\bin\toxtunnel.exe`. **The MSI does NOT auto-register the SCM service** (the WiX patch is shelved in `cmake/Packaging.cmake` until the correct CPack-generated component Id is discovered). Workflow: user runs the MSI, creates `C:\ProgramData\ToxTunnel\config.yaml`, then registers the service explicitly: `& 'C:\Program Files\ToxTunnel\bin\toxtunnel.exe' install-windows-service -c 'C:\ProgramData\ToxTunnel\config.yaml'`, then `sc start ToxTunnel`. The bundled `scripts/install.ps1` one-liner does all of this automatically (download → install → seed config → start service) based on `--Mode`. Removal: `uninstall-windows-service`. Upgrading in place (`msiexec /i new.msi /qn`) keeps the config, `data\` and the registered service; stop the service first and start it again afterwards. **Do not launch a second daemon from an SSH
...[truncated 25 chars]

• Confidence: 82% confidence
• Finding: The skill contains instructions for enabling persistent services via systemd, launchd, and Windows SCM. Persistence is not inherently malicious here, but in an agent-operated environment it creates durable system changes that can outlast user intent and can be abused to maintain unauthorized long-running access.

Session Persistence

Medium

• Category: Rogue Agent

Content

3. **Minimum privilege by default.** When generating rules.yaml, only allow the exact host:port combinations needed. Each friend gets their own rule entry with explicit 64-char hex public key.
4. **No friend wildcards.** The `friend` field in rules.yaml must be an exact 64-character hex public key. Never use `*` for friend identity.
5. **OS-aware.** Detect or ask the user's OS and tailor paths, commands, and service management:
   - macOS (package): `binary: /usr/local/bin/toxtunnel`; example config at `/usr/local/share/toxtunnel/config.yaml.example`. The pkg postinstall **automatically** seeds `/usr/local/etc/toxtunnel/config.yaml` from the example, installs `com.toxtunnel.daemon.plist` into `/Library/LaunchDaemons/`, and runs `launchctl bootstrap`. The daemon then honours `service.allow_client_daemon` / `service.auto_start` and exits 0 cleanly when gated off.
   - Linux (package): `binary: /usr/bin/toxtunnel`, `config: /etc/toxtunnel/config.yaml`, `data: /var/lib/toxtunnel`, service: `toxtunnel.service` (`Type=notify`, `RemainAfterExit=yes`). The postinst seeds the config from the example and runs `systemctl enable --now`. Server installs come up online; client installs idle (`active (exited)`) until the user fills in `client.server_id` and sets `service.allow_client_daemon: true`.
   - Windows (package): `binary: C:\Program Files\ToxTunnel\bin\toxtunnel.exe`. **The MSI does NOT auto-register the SCM service** (the WiX patch is shelved in `cmake/Packaging.cmake` until the correct CPack-generated component Id is discovered). Workflow: user runs the MSI, creates `C:\ProgramData\ToxTunnel\config.yaml`, then registers the service explicitly: `& 'C:\Program Files\ToxTunnel\bin\toxtunnel.exe' install-windows-service -c 'C:\ProgramData\ToxTunnel\config.yaml'`, then `sc start ToxTunnel`. The bundled `scripts/install.ps1` one-liner does all of this automatically (download → install → seed config → start service) based on `--Mode`. Removal: `uninstall-windows-service`. Upgr
...[truncated 25 chars]

• Confidence: 80% confidence
• Finding: The macOS launchd plist installation guidance describes automatic daemon registration and startup. In this skill's context, that makes the tunnel easy to establish as a long-lived background service, which is operationally useful but also increases the risk of stealthy or unintended continued remote-access exposure.

External Script Fetching

Low

• Category: Supply Chain

Content

- Windows (package): `binary: C:\Program Files\ToxTunnel\bin\toxtunnel.exe`. **The MSI does NOT auto-register the SCM service** (the WiX patch is shelved in `cmake/Packaging.cmake` until the correct CPack-generated component Id is discovered). Workflow: user runs the MSI, creates `C:\ProgramData\ToxTunnel\config.yaml`, then registers the service explicitly: `& 'C:\Program Files\ToxTunnel\bin\toxtunnel.exe' install-windows-service -c 'C:\ProgramData\ToxTunnel\config.yaml'`, then `sc start ToxTunnel`. The bundled `scripts/install.ps1` one-liner does all of this automatically (download → install → seed config → start service) based on `--Mode`. Removal: `uninstall-windows-service`. Upgrading in place (`msiexec /i new.msi /qn`) keeps the config, `data\` and the registered service; stop the service first and start it again afterwards. **Do not launch a second daemon from an SSH session** (`Start-Process` inside `ssh win "..."`): Win32-OpenSSH tears the session's job object down when the command returns and the daemon dies silently (no log line). Use the service, a Scheduled Task, or `Invoke-CimMethod -ClassName Win32_Process -MethodName Create`.
   - For manual installs, use home-directory paths as before.
6. **Prefer the one-line installer, then native packages, then source.** Recommend the one-liner first (it auto-detects arch + package format and seeds a mode-appropriate config):
   - macOS/Linux: `curl -fsSL https://raw.githubusercontent.com/agentx-icu/tox-tcp-tunnel/master/scripts/install.sh | sudo sh -s -- --mode {server|client}`
   - Windows (Administrator PowerShell): `$env:TOXTUNNEL_MODE='{server|client}'; irm https://raw.githubusercontent.com/agentx-icu/tox-tcp-tunnel/master/scripts/install.ps1 | iex`
   Fall back to direct DEB/RPM/.pkg/MSI download from GitHub Releases when the user can't pipe to sh/iex (locked-down environments). Only suggest building from source when no pre-built package exists for the target platform.
7. **Safe defaults.** `tox.bootstrap_mo
...[truncated 25 chars]

• Confidence: 95% confidence
• Finding: The skill recommends fetching and immediately executing remote install scripts from GitHub (`curl ... | sudo sh` and PowerShell `irm ... | iex`). This is a classic supply-chain and integrity risk: if the upstream content, transport trust, or referenced branch is compromised, arbitrary code executes on the host, in one case with root privileges.

Chaining Abuse

High

• Category: Tool Misuse

Content

- Windows (package): `binary: C:\Program Files\ToxTunnel\bin\toxtunnel.exe`. **The MSI does NOT auto-register the SCM service** (the WiX patch is shelved in `cmake/Packaging.cmake` until the correct CPack-generated component Id is discovered). Workflow: user runs the MSI, creates `C:\ProgramData\ToxTunnel\config.yaml`, then registers the service explicitly: `& 'C:\Program Files\ToxTunnel\bin\toxtunnel.exe' install-windows-service -c 'C:\ProgramData\ToxTunnel\config.yaml'`, then `sc start ToxTunnel`. The bundled `scripts/install.ps1` one-liner does all of this automatically (download → install → seed config → start service) based on `--Mode`. Removal: `uninstall-windows-service`. Upgrading in place (`msiexec /i new.msi /qn`) keeps the config, `data\` and the registered service; stop the service first and start it again afterwards. **Do not launch a second daemon from an SSH session** (`Start-Process` inside `ssh win "..."`): Win32-OpenSSH tears the session's job object down when the command returns and the daemon dies silently (no log line). Use the service, a Scheduled Task, or `Invoke-CimMethod -ClassName Win32_Process -MethodName Create`.
   - For manual installs, use home-directory paths as before.
6. **Prefer the one-line installer, then native packages, then source.** Recommend the one-liner first (it auto-detects arch + package format and seeds a mode-appropriate config):
   - macOS/Linux: `curl -fsSL https://raw.githubusercontent.com/agentx-icu/tox-tcp-tunnel/master/scripts/install.sh | sudo sh -s -- --mode {server|client}`
   - Windows (Administrator PowerShell): `$env:TOXTUNNEL_MODE='{server|client}'; irm https://raw.githubusercontent.com/agentx-icu/tox-tcp-tunnel/master/scripts/install.ps1 | iex`
   Fall back to direct DEB/RPM/.pkg/MSI download from GitHub Releases when the user can't pipe to sh/iex (locked-down environments). Only suggest building from source when no pre-built package exists for the target platform.
7. **Safe defaults.** `tox.bootstrap_mo
...[truncated 25 chars]

• Confidence: 96% confidence
• Finding: The explicit command chain `curl ... | sudo sh` combines remote content retrieval with immediate privileged execution, which is one of the highest-risk command patterns in operational tooling. In a skill that already facilitates remote access/tunneling, this becomes even more dangerous because it lowers the barrier to full host compromise if the install source or invocation is manipulated.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.