Ztm Tunnel

• Analyzed: May 12, 2026, 4:18 AM
• Findings: 0
• Version: 1.0.0
• Hash: ed3563b56225df54fe705bdc8642e59f5b84d2b2c4082e86414e3eee9e391c2b
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: ztm-tunnel Version: 1.0.0 The skill bundle is designed to install and manage ZTM (Zero Trust Mesh) tunnels. The `install.sh` script downloads the `ztm` binary from its official GitHub releases page (`github.com/flomesh-io/ztm`), installs it to `/usr/local/bin` (using `sudo` if necessary), starts the ZTM agent, and installs the ZTM tunnel app. The `SKILL.md` and `README.md` provide instructions for using the `ztm` CLI and its local API, all consistent with the stated purpose of creating and managing network tunnels. There is no evidence of data exfiltration, unauthorized persistence, or prompt injection attempts designed to trick an AI agent into malicious actions beyond the scope of ZTM tunnel management. All network calls and file system operations are directly related to the installation and operation of the ZTM tool.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI04: Agentic Supply Chain Vulnerabilities

Concern

What this means

If the release source, account, or network download were compromised, the user could install and run a privileged network tool system-wide.

Why it was flagged

The installer dynamically downloads the latest release archive, extracts it, and may install the resulting binary into a system path with sudo, without a pinned version, checksum, or signature verification.

Skill content

LATEST_VERSION=$(curl -s https://api.github.com/repos/flomesh-io/ztm/releases/latest | grep -o '"tag_name":.*' | cut -d'"' -f4)
...
curl -L -o "$FILENAME" "$DOWNLOAD_URL"
tar -xzf "$FILENAME"
sudo mv bin/ztm /usr/local/bin/ztm

Recommendation

Prefer a manually verified ZTM install, pin a known version, and check release signatures or checksums before running the installer.

ASI02: Tool Misuse and Exploitation

Note

What this means

A tunnel created with broad listen addresses or sensitive targets can unintentionally expose services to other reachable clients or mesh endpoints.

Why it was flagged

The documented tunnel commands can bind to all network interfaces and forward sensitive services such as SSH across the mesh.

Skill content

ztm tunnel open inbound home-server --listen 0.0.0.0:22 --exits <office-endpoint-id>
...
ztm tunnel open outbound home-server --targets 192.168.1.10:22

Recommendation

Use the narrowest listen address and port possible, verify the endpoint IDs and targets, and close tunnels when they are no longer needed.

ASI10: Rogue Agents

Note

What this means

A local network agent may keep running after setup and continue to provide tunnel-management capability on the machine.

Why it was flagged

The installer starts the ZTM agent as part of setup, which creates a local service the skill later uses.

Skill content

echo -e "${YELLOW}🚀 Step 3: Starting ZTM Agent...${NC}"
...
ztm start agent

Recommendation

Only start the agent when needed, understand how to stop it, and ensure localhost access to the ZTM API is appropriately protected on your system.

ASI03: Identity and Privilege Abuse

Note

What this means

Anyone with access to a valid permit may be able to join or affect the intended mesh depending on ZTM policy.

Why it was flagged

Joining a mesh uses a permit file, which is authorization material for ZTM mesh membership.

Skill content

ztm join <mesh-name> --as <your-endpoint-name> --permit <permit-file.json>

Recommendation

Protect permit files, use only trusted mesh permits, and remove or rotate permits according to ZTM guidance.