Proxima VPS autoamtion

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:36 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Proxima VPS setup guide, but it recommends several over-privileged and mutable deployment choices that deserve review before installation.

Review and harden this before installing: pin the Proxima source to a reviewed commit or release, use a locked dependency install, run noVNC under a restricted non-root account, and use a dedicated non-root SSH identity for tunnels and MCP. Keep REST/VNC/noVNC loopback-only and install on an isolated VPS or VM, not a primary machine.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: references/server-setup-runbook.md:26

Finding

Mutable Third-Party Source and Dependencies Are Installed Without Integrity Pinning

Content

View full analysis

Vulnerability Details

File Location: references/server-setup-runbook.md, lines 26–48
Vulnerability Type: Unpinned third-party code and dependency installation
Risk Level: Medium

Vulnerable Code

bash

git clone https://github.com/alkindivv/Proxima /Proxima
id proxima >/dev/null 2>&1 || useradd -m -s /bin/bash proxima
chown -R proxima:proxima /Proxima

bash

runuser -u proxima -- bash -lc 'cd /Proxima && npm install'

Technical Analysis

The repository is cloned from its mutable default branch without specifying or verifying a reviewed release tag or full commit hash. The subsequent npm install resolves and installs third-party dependency content at deployment time and may execute npm lifecycle scripts.

As a result, the effective code installed by the Skill can change after this Skill has been reviewed. A compromised upstream repository, dependency release, maintainer account, or npm package could introduce code that is executed during installation or when the persistent Proxima service starts.

Attack Path

1. An attacker compromises the upstream Proxima repository, an npm dependency, or a relevant publisher account.
2. The attacker adds malicious application code or an npm lifecycle script.
3. An agent follows the runbook and clones the current default branch.
4. The agent runs npm install as the proxima account.
5. The malicious lifecycle script executes during installation, or the modified application executes when proxima-app.service starts.
6. The payload gains access to resources available to the proxima account, including application data, browser sessions, provider credentials or cookies accessible to the application, and loopback-only Proxima interfaces.

Impact Assessment

Successful exploitation provides code execution with the privileges of the proxima runtime account. This does not directly grant root privileges, but it can ex ...[truncated 252 chars]

Remediation

View remediation

Remediation Suggestions

• Pin Proxima to a reviewed release and immutable full commit hash.
• Verify the checked-out commit against the expected hash before installing or running it.
• Require a reviewed npm lockfile and use npm ci instead of npm install.
• Verify package integrity and review all required npm lifecycle scripts.
• Consider initially installing with npm ci --ignore-scripts, then explicitly enable only scripts that have been reviewed and are necessary.
• Perform dependency vulnerability and provenance checks before deployment.
• Document an explicit upgrade process rather than automatically consuming the latest upstream branch.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/server-setup-runbook.md:200

Finding

Persistent noVNC Service Runs as Root Without a Functional Requirement

Content

View full analysis

Vulnerability Details

File Location: references/server-setup-runbook.md, lines 200–213
Vulnerability Type: Excessive service privileges
Risk Level: Medium

Vulnerable Code

ini

[Unit]
Description=Proxima noVNC server
After=proxima-user-x11vnc.service
Requires=proxima-user-x11vnc.service

[Service]
User=root
ExecStart=/usr/share/novnc/utils/novnc_proxy --listen 127.0.0.1:6081 --vnc 127.0.0.1:5902
Restart=always
RestartSec=2

[Install]
WantedBy=multi-user.target

Technical Analysis

noVNC listens on TCP port 6081, which is an unprivileged port, and connects to another loopback service on port 5902. Neither operation requires root privileges. Running the proxy as root violates least privilege and unnecessarily converts any exploitable flaw in noVNC, websockify, or its request-processing dependencies into a potential root-level compromise.

The service is also enabled for startup and configured to restart indefinitely. Persistent startup is consistent with the declared always-on VPS architecture, so the persistence itself is not classified as a hidden backdoor. The security issue is that this persistent network-facing process receives unrestricted root privileges.

Attack Path

1. An attacker obtains access to the loopback noVNC listener through an authorized SSH tunnel, a compromised SSH account, or an existing local process.
2. The attacker sends input that exploits a vulnerability in noVNC, websockify, or an associated request-processing component.
3. The vulnerable process executes attacker-controlled code.
4. Because systemd starts the process with User=root, the payload executes with root privileges.
5. The attacker can modify system files, credentials, services, and other users' data, resulting in complete VPS compromise.

Impact Assessment

Successful exploitation can provide full root control of the VPS. This includes access to all Proxima data and sessions, sy ...[truncated 217 chars]

Remediation

View remediation

Remediation Suggestions

• Run noVNC as the existing proxima account or, preferably, a dedicated restricted novnc service account.
• Ensure the service account can read only the noVNC assets and connect only to the required loopback VNC endpoint.
• Add systemd hardening controls such as:

ini

User=novnc
Group=novnc
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
LockPersonality=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6

• Retain the loopback-only --listen 127.0.0.1:6081 setting.
• Keep noVNC and websockify patched and remove the service entirely when browser-based VNC access is not required.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/local-access-and-mcp.md:9

Finding

Routine Tunneling and MCP Access Are Configured Through the Root SSH Account

Content

View full analysis

Vulnerability Details

File Location: references/local-access-and-mcp.md, lines 9–36
Vulnerability Type: Excessive SSH privileges for routine client access
Risk Level: Medium

Vulnerable Code

bash

ssh -L 6081:127.0.0.1:6081 -L 3210:127.0.0.1:3210 root@<VPS_IP>

bash

ssh -L 5902:127.0.0.1:5902 root@<VPS_IP>

sshconfig

Host proxima-vps
  HostName <VPS_IP>
  User root
  IdentityFile ~/.ssh/id_ed25519
  IdentitiesOnly yes

Technical Analysis

Root access may be necessary during initial package installation and systemd provisioning, but it is not required for recurring port forwarding or invocation of the proxima-mcp wrapper. The recommended SSH alias is subsequently used by IDE MCP clients, meaning routine IDE operations are performed through an unrestricted root SSH identity.

This design unnecessarily expands the impact of private-key theft, SSH agent abuse, malicious IDE extensions, or command substitution in client configuration. A credential intended only to reach loopback services and MCP instead grants complete administrative access to the host.

The Skill does not create, copy, or exfiltrate SSH keys. The issue is the excessive privilege assigned to the identity used for ordinary access.

Attack Path

1. A malicious local process, compromised IDE extension, or other attacker gains access to the configured private key or the ability to use the user's SSH agent.
2. The attacker connects to the proxima-vps alias.
3. The SSH server authenticates the attacker directly as root.
4. Instead of being limited to MCP execution or specific port forwards, the attacker starts an unrestricted root shell or executes arbitrary root commands.
5. The attacker takes complete control of the VPS, accesses all application sessions and data, and may install additional persistence.

Impact Assessment

Successful exploitation grants unrestricted root p ...[truncated 262 chars]

Remediation

View remediation

Remediation Suggestions

• Create a dedicated, non-root SSH account for tunnels and MCP access.
• Do not grant that account general-purpose sudo privileges.
• Disable direct root SSH login after provisioning by setting PermitRootLogin no, subject to maintaining a tested administrative recovery path.
• Use a separate administrative account and identity for maintenance.
• Restrict the routine access key in authorized_keys with options appropriate to its function, such as restrict, permitopen, and a forced command.
• Where one key must support MCP only, force execution of proxima-mcp and reject arbitrary commands.
• Where port forwarding is required, allow only the necessary destinations, such as 127.0.0.1:3210, 127.0.0.1:5902, and 127.0.0.1:6081.
• Use separate restricted identities for MCP and port forwarding if forced-command and forwarding requirements conflict.
• Protect private keys with appropriate filesystem permissions and, where client compatibility permits, passphrases or hardware-backed credentials.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/local-access-and-mcp.md (reported line 35)May include surrounding context.

Host proxima-vps HostName <VPS_IP> User root IdentityFile ~/.ssh/id_ed25519 IdentitiesOnly yes

text

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documentation is written as an instruction-bearing README entirely in Indonesian, beginning with "Skill ini dipakai...", with no indication that users may choose another language or that the skill is intentionally region-specific. Under the policy, forcing a specific language without opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The runbook enables multiple network-facing and data-bearing features (restApiEnabled plus several third-party provider integrations) without any explicit warning about privacy, credential handling, or exposure risk. In the context of a remote VPS deployment, operators may enable APIs and model backends without understanding that local loopback protections can later be bypassed via SSH tunnels or misconfiguration, increasing the chance of unintended data disclosure.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/server-setup-runbook.md (reported line 168)May include surrounding context.

md

Environment=XDG_RUNTIME_DIR=/run/user/<UID>
ExecStartPre=/bin/mkdir -p /run/user/<UID>
ExecStartPre=/bin/chown proxima:proxima /run/user/<UID>
ExecStartPre=/bin/chmod 700 /run/user/<UID>
ExecStart=/usr/bin/startxfce4
Restart=always
RestartSec=2

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/server-setup-runbook.md (reported line 227)May include surrounding context.

bash

systemctl daemon-reload
systemctl enable --now proxima-user-xvfb.service
systemctl enable --now proxima-user-xfce.service
systemctl enable --now proxima-user-x11vnc.service
systemctl enable --now proxima-user-novnc.service

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/server-setup-runbook.md (reported line 228)May include surrounding context.

bash

systemctl daemon-reload
systemctl enable --now proxima-user-xvfb.service
systemctl enable --now proxima-user-xfce.service
systemctl enable --now proxima-user-x11vnc.service
systemctl enable --now proxima-user-novnc.service

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/server-setup-runbook.md (reported line 229)May include surrounding context.

bash

systemctl daemon-reload
systemctl enable --now proxima-user-xvfb.service
systemctl enable --now proxima-user-xfce.service
systemctl enable --now proxima-user-x11vnc.service
systemctl enable --now proxima-user-novnc.service

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/server-setup-runbook.md (reported line 230)May include surrounding context.

bash

systemctl daemon-reload
systemctl enable --now proxima-user-xvfb.service
systemctl enable --now proxima-user-xfce.service
systemctl enable --now proxima-user-x11vnc.service
systemctl enable --now proxima-user-novnc.service

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/server-setup-runbook.md (reported line 261)May include surrounding context.

bash

systemctl daemon-reload
systemctl enable --now proxima-user-xvfb.service
systemctl enable --now proxima-user-xfce.service
systemctl enable --now proxima-user-x11vnc.service
systemctl enable --now proxima-user-novnc.service

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The troubleshooting step tells users to open an SSH tunnel as root, which conflicts with the skill’s stated non-root deployment model and normalizes direct root SSH access for routine operations. While the command itself is only port forwarding and does not expose the service publicly, encouraging root login increases the attack surface, weakens least-privilege practices, and can lead users to enable or rely on privileged remote access unnecessarily.

Content

No source excerpt is available for this finding.