一键内网穿透

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:26 AM UTC
• Version: 1.0.0

Overview

This skill creates public project URLs as advertised, but it also automatically changes the host, downloads executable code, and leaves background tunnel state that users should review first.

Install only if you are comfortable with a skill that can expose local projects to the public internet, install system packages, download and run a third-party native agent, keep shared tunnel state under your home directory, and stop local processes by port. Review or patch the scripts first if you need explicit consent, HTTPS/WSS control channels, verified binaries, or reliable cleanup.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

• Location: assets/project-tunnel.sh:521
• Finding: Unverified Mutable Native Binary Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `assets/project-tunnel.sh:521-554`, with execution at `assets/project-tunnel.sh:982-995` and `assets/project-tunnel.sh:1130-1133` **Vulnerability Type**: Unverified remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash ensure_agent_binary() { local platform asset release_base url tmp platform="$(detect_platform)" AGENT_EXT="" if [[ "${platform}" == windows-* ]]; then AGENT_EXT=".exe" fi AGENT_GITHUB_REPO="${AGENT_GITHUB_REPO:-ChangfengHU/tunneling}" AGENT_VERSION="${AGENT_VERSION:-latest}" AGENT_RELEASE_BASE="${AGENT_RELEASE_BASE:-https://github.com/${AGENT_GITHUB_REPO}/releases}" AGENT_DIR="${AGENT_DIR:-${HOME}/.tunneling/bin}" mkdir -p "${AGENT_DIR}" AGENT_BIN="${AGENT_BIN:-${AGENT_DIR}/agent${AGENT_EXT}}" FORCE_AGENT_DOWNLOAD="${FORCE_AGENT_DOWNLOAD:-0}" if [[ "${FORCE_AGENT_DOWNLOAD}" != "1" && -f "${AGENT_BIN}" ]]; then if [[ "${AGENT_EXT}" == ".exe" || -x "${AGENT_BIN}" ]]; then return 0 fi fi asset="agent-${platform}${AGENT_EXT}" if [[ "${AGENT_VERSION}" == "latest" ]]; then url="${AGENT_RELEASE_BASE}/latest/download/${asset}" else url="${AGENT_RELEASE_BASE}/download/${AGENT_VERSION}/${asset}" fi echo "[agent] downloading ${asset}" tmp="${AGENT_BIN}.tmp" rm -f "${tmp}" curl -fL --retry 3 --retry-delay 1 -o "${tmp}" "${url}" mv "${tmp}" "${AGENT_BIN}" chmod +x "${AGENT_BIN}" || true echo "[agent] ready: ${AGENT_BIN}" } ``` The downloaded file is subsequently placed in a generated runner and executed: ```bash cat > "${MACHINE_AGENT_RUNNER}" <<EOF_RUNNER #!/usr/bin/env bash set -euo pipefail export PATH='${PATH_VALUE}' exec '${AGENT_BIN}' \ -server '${AGENT_SERVER}' \ -token '${ttoken}' \ -route-sync-url '${AGENT_ROUTE_SYNC_URL}' \ -tunnel-id '${tid}' \ -tunnel-token '${ttoken}' \ -admin-addr '${MACHINE_AGENT_ADMIN_ADDR}' \ -config '${MACHINE_AGENT_CONFIG}' EOF_RUNNER ch ...[truncated 1862 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bundle an audited agent binary with the Skill where feasible. 2. Otherwise, pin an immutable release version rather than using `latest`. 3. Publish trusted SHA-256 hashes independently and verify the selected artifact before moving or executing it. 4. Prefer signed artifacts and validate the signature against a pinned publisher key. 5. Download to a securely created temporary file and reject symbolic links or unexpected file types. 6. Require explicit user approval before the first download and before replacing an installed binary. 7. Record and display the artifact version, source URL, hash, and verification result. 8. Run the tunnel agent with sandboxing and the minimum filesystem and network access required. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/fix_env.sh:15
• Finding: Mutable Homebrew Installer Is Downloaded Directly Into a Shell<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fix_env.sh:15-29` **Vulnerability Type**: Download-to-shell remote code execution **Risk Level**: High ### Vulnerable Code ```bash install_macos() { local tool="$1" if ! command -v brew >/dev/null 2>&1; then echo "[fix] installing Homebrew first..." /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" fi case "$tool" in python3) brew install python3 ;; node|npm) brew install node ;; curl) brew install curl ;; lsof) echo "[fix] lsof is part of macOS base — reinstall Xcode CLI tools:" && xcode-select --install ;; *) brew install "$tool" ;; esac } ``` This function is reached automatically from `scripts/auto_start.sh:57-64`: ```bash ENV_OUT="$("${SCRIPT_DIR}/check_env.sh" 2>&1)" || true if echo "${ENV_OUT}" | grep -q "❌"; then MISSING="$(echo "${ENV_OUT}" | sed 's/.*missing: //')" echo "[auto] fixing environment: ${MISSING}" # shellcheck disable=SC2086 "${SCRIPT_DIR}/fix_env.sh" ${MISSING} fi ``` ### Technical Analysis The script retrieves the Homebrew installation script from the mutable `HEAD` branch and immediately passes its contents to `/bin/bash -c`. There is no opportunity to inspect the downloaded content and no pinned commit, checksum, or signature validation. The source is the official Homebrew GitHub repository, not a pastebin. Nevertheless, executing the mutable branch directly creates a supply-chain code-execution boundary. The Skill's autonomous workflow makes this more serious because environment repair is performed without presenting the command or requesting approval. ### Attack Path 1. A required command is absent on macOS and Homebrew is not installed. 2. `auto_start.sh` detects the missing dependency and invokes `fix_env.sh`. 3. `fix_env.sh` retrieves the current content of Homebrew's `HEAD/install.sh`. 4. A compromised upstream repository, account, delivery path, or changed ...[truncated 633 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove direct `curl`-to-shell execution. 2. Do not install Homebrew automatically as part of tunnel startup. 3. Stop with clear manual installation instructions when required dependencies are absent. 4. If automated installation is retained, pin the installer to a reviewed immutable commit and verify a trusted cryptographic digest before execution. 5. Save the installer locally, display its origin and planned operation, and require explicit user confirmation. 6. Separate environment provisioning from normal tunnel execution so starting a tunnel cannot silently modify the development environment. ]]>

T06 · System Persistence

Error

• Location: assets/project-tunnel.sh:829
• Finding: Machine-Wide Tunnel Agent Remains Running After the Documented Stop Operation<![CDATA[ ## Vulnerability Details **File Location**: `assets/project-tunnel.sh:600-606`, `assets/project-tunnel.sh:829-851`, and `assets/project-tunnel.sh:899-921` **Vulnerability Type**: Unmanaged background persistence **Risk Level**: High ### Vulnerable Code The background process is detached with `nohup`: ```bash start_runner() { local runner="$1" local pid_file="$2" local log_file="$3" nohup "${runner}" >>"${log_file}" 2>&1 & echo $! >"${pid_file}" } ``` The documented `stop` path only references per-project process files and ports: ```bash if [[ "${cmd}" == "stop" ]]; then if [[ -f "${STATE_FILE}" ]]; then stop_tunnel_id="$(state_get tunnel_id || true)" stop_hostname="$(state_get hostname || true)" stop_target="$(state_get target || true)" if [[ -z "${stop_target}" ]]; then stop_target="${TARGET}" fi if [[ -n "${stop_tunnel_id}" && -n "${stop_hostname}" ]]; then stop_payload="$($PYTHON - "${stop_tunnel_id}" "${stop_hostname}" "${stop_target}" <<'PY' import json import sys tunnel_id, hostname, target = sys.argv[1:4] print(json.dumps({ "tunnel_id": tunnel_id, "hostname": hostname, "target": target, "enabled": False, })) PY )" api_post "${CONTROL_API_BASE}/api/routes" "${stop_payload}" >/dev/null || true fi fi stop_by_pid_file "${APP_PID_FILE}" stop_by_pid_file "${AGENT_PID_FILE}" stop_by_tcp_port "${PROJECT_PORT}" stop_by_tcp_port "${AGENT_ADMIN_PORT}" echo "[OK] stopped: ${PROJECT_KEY}" exit 0 fi ``` Machine-agent state is initialized only after that branch: ```bash MACHINE_DIR="${HOME}/.tunneling" MACHINE_ID_FILE="${MACHINE_DIR}/machine_id" MACHINE_STATE_FILE="${MACHINE_DIR}/machine_state.json" MACHINE_AGENT_DIR="${MACHINE_DIR}/machine-agent" MACHINE_AGENT_LOG="${MACHINE_AGENT_DIR}/agent.log" MACHINE_AGENT_PID="${MACHINE_AGENT_DIR}/agent.pid" MACHINE_AGENT_CONFIG="${MACHINE_AGENT_DIR}/config.json" MACHINE_AGENT_RUNNER="${MACHINE_AGENT_DIR}/run-agent.sh" MACHINE_ ...[truncated 1726 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make `stop` remove the selected route and determine whether any active routes still require the shared agent. 2. If no routes remain, terminate the PID from `~/.tunneling/machine-agent/agent.pid` and verify that port `17000` is closed. 3. Add an explicit `stop-all` or `uninstall` operation that removes the agent binary, runner scripts, tokens, state, and logs. 4. Do not print a successful stopped status until all intended processes and external routes have been verified as inactive. 5. Clearly disclose that the agent is shared and backgrounded before starting it. 6. Prefer a foreground lifecycle tied to the initiating command unless the user explicitly opts into a persistent shared agent. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: assets/project-tunnel.sh:712
• Finding: Tunnel Credentials and Control Messages Use Plaintext Network Protocols<![CDATA[ ## Vulnerability Details **File Location**: `assets/project-tunnel.sh:712-718`, `assets/project-tunnel.sh:771-772`, and `assets/project-tunnel.sh:941-960` **Vulnerability Type**: Plaintext transmission and insufficiently protected credential storage **Risk Level**: High ### Vulnerable Code ```bash else BASE_DOMAIN="vyibc.com" fi CONTROL_API_BASE="${CONTROL_API_BASE:-http://152.32.214.95:3002/control}" PUBLIC_SCHEME="${PUBLIC_SCHEME:-https}" DOMAIN_MODE="${DOMAIN_MODE:-fixed}" ``` ```bash AGENT_SERVER="${AGENT_SERVER:-ws://152.32.214.95/connect}" AGENT_ROUTE_SYNC_URL="${AGENT_ROUTE_SYNC_URL:-http://152.32.214.95/_tunnel/agent/routes}" TARGET_HOST="${TARGET_HOST:-127.0.0.1}" TARGET="${TARGET:-${TARGET_HOST}:${PROJECT_PORT}}" ``` Tunnel credentials are written to machine state without explicit restrictive permissions: ```bash machine_state_write() { # Args: tunnel_id tunnel_token $PYTHON - "${MACHINE_STATE_FILE}" "${MACHINE_ID}" "${USER_ID}" \ "$1" "$2" "${MACHINE_AGENT_ADMIN_ADDR}" <<'PY' import json, sys, os from datetime import datetime, timezone f, machine_id, user_id, tunnel_id, tunnel_token, agent_admin_addr = sys.argv[1:] os.makedirs(os.path.dirname(os.path.abspath(f)), exist_ok=True) data = {"machine_id": machine_id, "user_id": user_id, "tunnel_id": tunnel_id, "tunnel_token": tunnel_token, "agent_admin_addr": agent_admin_addr, "updated_at": datetime.now(timezone.utc).isoformat()} open(f, "w").write(json.dumps(data, indent=2)) PY } ``` ### Technical Analysis Tunnel creation and route-management API requests default to plain HTTP. The agent connection defaults to unencrypted WebSocket, and route synchronization also uses HTTP. Tunnel tokens returned by the control service are later supplied to the native agent. An on-path attacker can observe or manipulate unencrypted control traffic. Depending on protocol behavior, this can expose tunnel identifiers and tokens, alter route assignments, or direct the client ...[truncated 1471 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace all control endpoints with HTTPS and all agent WebSocket endpoints with WSS. 2. Use a stable DNS hostname and enforce normal certificate validation rather than relying on a raw IP address. 3. Authenticate and integrity-protect all route-control requests. 4. Consider certificate or public-key pinning where operationally appropriate. 5. Create `~/.tunneling` and token-bearing subdirectories with mode `0700`. 6. Create state and runner files containing tokens with mode `0600`, independent of the user's umask. 7. Avoid embedding tokens directly in command-line arguments or generated scripts; pass them through a protected file descriptor or narrowly permissioned configuration file. 8. Rotate all existing tunnel tokens after migrating to secure transport. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/fix_env.sh:31
• Finding: Autonomous Tunnel Startup Performs Privileged System Package Installation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fix_env.sh:31-52`, invoked by `scripts/auto_start.sh:57-64` **Vulnerability Type**: Excessive privilege and unauthorized host modification **Risk Level**: High ### Vulnerable Code ```bash install_linux() { local tool="$1" if command -v apt-get >/dev/null 2>&1; then case "$tool" in python3) sudo apt-get install -y python3 ;; node|npm) sudo apt-get install -y nodejs npm ;; curl) sudo apt-get install -y curl ;; lsof) sudo apt-get install -y lsof ;; *) sudo apt-get install -y "$tool" ;; esac elif command -v yum >/dev/null 2>&1; then case "$tool" in python3) sudo yum install -y python3 ;; node|npm) sudo yum install -y nodejs npm ;; curl) sudo yum install -y curl ;; lsof) sudo yum install -y lsof ;; *) sudo yum install -y "$tool" ;; esac else echo "❌ unknown package manager — please install '$tool' manually" >&2 exit 1 fi } ``` Automatic invocation occurs during normal startup: ```bash ENV_OUT="$("${SCRIPT_DIR}/check_env.sh" 2>&1)" || true if echo "${ENV_OUT}" | grep -q "❌"; then MISSING="$(echo "${ENV_OUT}" | sed 's/.*missing: //')" echo "[auto] fixing environment: ${MISSING}" # shellcheck disable=SC2086 "${SCRIPT_DIR}/fix_env.sh" ${MISSING} fi ``` ### Technical Analysis A request to expose a project can cause the Skill to invoke `sudo apt-get` or `sudo yum` and install packages globally. The `-y` flag suppresses package-manager confirmation, while the Skill instructions explicitly direct autonomous execution without user interaction. System-wide installation is broader than necessary for tunneling an already-running local port. Installing Node.js and npm is a project-runtime assumption rather than a strict tunnel requirement. Package installation can also execute maintainer lifecycle scripts with elevated privileges. The wildcard package branch is not directly exposed to a ...[truncated 1105 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not invoke `sudo` automatically from normal Skill startup. 2. Report missing dependencies and provide exact manual installation instructions. 3. Require explicit, informed user approval before any host-wide package installation. 4. Separate dependency setup into an opt-in administrative command. 5. Minimize tunnel dependencies and do not require Node.js or npm when exposing an already-running service. 6. Where practical, use a user-scoped, pinned, verified tunnel component instead of modifying the system package database. 7. Remove the wildcard package-install branch or strictly allow-list supported package names. 8. Display the package source, version, and commands before execution. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: assets/project-tunnel.sh:583
• Finding: Startup and Stop Logic Can Terminate Unrelated Processes by Port Number<![CDATA[ ## Vulnerability Details **File Location**: `assets/project-tunnel.sh:583-599` and `assets/project-tunnel.sh:1117-1133` **Vulnerability Type**: Unsafe process termination and local denial of service **Risk Level**: High ### Vulnerable Code ```bash stop_by_tcp_port() { local port="$1" local pid pid="$(pid_on_tcp_port "${port}" || true)" if [[ -n "${pid}" ]]; then kill "${pid}" >/dev/null 2>&1 || true sleep 1 if is_pid_running "${pid}"; then kill -9 "${pid}" >/dev/null 2>&1 || true fi fi } ``` The function is called during normal startup before launching the application and agent: ```bash echo "[3/5] restart local app + ensure machine agent" stop_by_pid_file "${APP_PID_FILE}" stop_by_tcp_port "${PROJECT_PORT}" start_runner "${APP_RUNNER}" "${APP_PID_FILE}" "${APP_LOG}" # Machine-agent: start only if not already running if is_machine_agent_running; then echo "[machine-agent] already running (pid=$(cat "${MACHINE_AGENT_PID}" 2>/dev/null || echo '?'))" else echo "[machine-agent] starting..." write_machine_agent_runner "${TUNNEL_ID}" "${TUNNEL_TOKEN}" # Stop any stale process on the admin port stop_by_tcp_port "${MACHINE_AGENT_ADMIN_PORT}" start_runner "${MACHINE_AGENT_RUNNER}" "${MACHINE_AGENT_PID}" "${MACHINE_AGENT_LOG}" fi ``` ### Technical Analysis The Skill identifies the first process listening on a TCP port using `lsof` and terminates it without verifying that the process was launched by this Skill. It first sends a normal termination signal and then escalates to `SIGKILL`. Possession of a port is not proof of process identity. A user-selected port, an incorrectly detected port, or the fixed machine-agent port can already belong to an unrelated application. The process ownership restrictions imposed by the operating system limit which PIDs the current user can kill, but any same-user process is at risk. ### Attack Path 1. An unrelated process owned by the same user listens on the selected project p ...[truncated 844 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never terminate a process solely because it owns a requested port. 2. If a port is occupied by an unrecognized process, abort and report the PID, executable, owner, and port conflict. 3. Only stop PIDs recorded by this Skill after validating process ownership, executable identity, start time, and expected command line. 4. Detect PID reuse by recording a process start timestamp or platform-specific process identity. 5. Do not use `SIGKILL` automatically; require explicit user authorization before force termination. 6. Select an unused admin port instead of terminating the existing listener on port `17000`. 7. Offer an explicit, separately confirmed `--replace-existing` option if replacement behavior is operationally necessary. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (40)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Copying or writing scripts into a user's project directory without clearly declaring that behavior is a meaningful integrity risk, especially when combined with shell execution and automation. Users may unknowingly end up with modified project contents or wrapper scripts that later execute with trust they did not intentionally grant.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Copying or writing scripts into a user's project directory without clearly declaring that behavior is a meaningful integrity risk, especially when combined with shell execution and automation. Users may unknowingly end up with modified project contents or wrapper scripts that later execute with trust they did not intentionally grant.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: Copying or writing scripts into a user's project directory without clearly declaring that behavior is a meaningful integrity risk, especially when combined with shell execution and automation. Users may unknowingly end up with modified project contents or wrapper scripts that later execute with trust they did not intentionally grant.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Copying or writing scripts into a user's project directory without clearly declaring that behavior is a meaningful integrity risk, especially when combined with shell execution and automation. Users may unknowingly end up with modified project contents or wrapper scripts that later execute with trust they did not intentionally grant.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: Copying or writing scripts into a user's project directory without clearly declaring that behavior is a meaningful integrity risk, especially when combined with shell execution and automation. Users may unknowingly end up with modified project contents or wrapper scripts that later execute with trust they did not intentionally grant.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger phrases include common requests like '启动项目' and 'start my project,' which can unintentionally invoke internet exposure and environment-changing behavior when a user may only want a local dev server. Because the skill's context is public exposure and automation, broad triggers materially raise the risk of accidental activation and unconsented external access.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill description does not prominently warn that it may expose a local project to the public internet and automatically install or change system packages. In this context, omission is especially dangerous because users may disclose internal apps or data externally and permit host modifications without informed consent.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill is designed to autonomously detect a project, start it, repair the environment, and expose it via a public URL, all without a user-facing warning about system and network consequences. This is dangerous because it can execute local code, install or modify dependencies, and publish a potentially sensitive development service to the internet without informed consent.

Credential Access

High

• Category: Privilege Escalation

Content

Default behavior (zero-config):
- PROJECT_DIR: current directory
- PROJECT_NAME: package.json.name or current folder name
- PROJECT_PORT: .tunnel-port > .env.local/.env PORT= > 3000
- USER_ID: current system user
- SUBDOMAIN: <project>-<user>
- DOMAIN_MODE: fixed (stable domain)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The cleanup logic kills processes by persisted PID files and by whatever process is currently listening on a port, including sibling-state cleanup and restart paths. If ports or PID files are stale or collide with unrelated services, the script can terminate unrelated local applications, causing denial of service or data loss.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script downloads an executable agent from GitHub at runtime and immediately marks it executable for later execution, without signature or checksum verification. This creates a supply-chain execution path not disclosed by the skill description, allowing compromise if the release source, network path, or repository is tampered with.

Credential Access

High

• Category: Privilege Escalation

Content

if [[ -f "${PROJECT_DIR}/.tunnel-port" ]]; then
    PROJECT_PORT="$(head -n1 "${PROJECT_DIR}/.tunnel-port" | tr -d '[:space:]')"
  else
    PROJECT_PORT="$(port_from_file "${PROJECT_DIR}/.env.local" || true)"
    if [[ -z "${PROJECT_PORT}" ]]; then
      PROJECT_PORT="$(port_from_file "${PROJECT_DIR}/.env" || true)"
    fi

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

else
    PROJECT_PORT="$(port_from_file "${PROJECT_DIR}/.env.local" || true)"
    if [[ -z "${PROJECT_PORT}" ]]; then
      PROJECT_PORT="$(port_from_file "${PROJECT_DIR}/.env" || true)"
    fi
    PROJECT_PORT="${PROJECT_PORT:-3000}"
  fi

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises and instructs shell execution, file reads/writes, and environment modification, but declares no tool scope or permission boundaries. This creates an authorization gap where an agent could perform filesystem and command actions without explicit limitation or user-visible consent, increasing the chance of unsafe execution.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The instruction requires replying with only `✅ 公网地址：<public_url>`, which forces a Chinese response regardless of the user's language or locale. This is a natural-language policy issue because no opt-in or language choice is provided, and earlier instructions/examples mix English and Chinese user inputs.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

scripts/auto_start.sh . 3000 --startsh scripts/dev.sh        # custom start script
    
    If auto_start.sh fails due to missing tools, run scripts/fix_env.sh <missing>, then retry.
    Never ask the user for input unless the port truly cannot be detected.

policy:
  allow_implicit_invocation: true

• Confidence: 97% confidence
• Finding: The instruction to avoid asking the user for input unless port detection fails removes an important human checkpoint before high-impact actions are taken. In context, the autonomous behavior includes shell script execution, environment modification, and external network exposure, making the lack of confirmation materially unsafe.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest explicitly enables implicit invocation without narrowly defined trigger constraints, allowing the skill to run based on broad natural-language phrases. In this skill, implicit execution is especially risky because invocation leads to network exposure and process/environment changes, so accidental or ambiguous triggers could expose a local project without clear user confirmation.

External Transmission

Medium

• Category: Data Exfiltration

Content

local body_file
  body_file="$(mktemp)"
  local status
  status="$(curl -sS -o "${body_file}" -w "%{http_code}" -X POST "${url}" \
    -H "Content-Type: application/json" \
    --data "${payload}")"
  if ((status < 200 || status >= 300)); then

• Confidence: 91% confidence
• Finding: The script sends JSON payloads to a remote control API to create/update routes and tunnels, which is necessary for the feature but still constitutes external transmission. In this context, the transmission is security-relevant because it enables public exposure of local services and sends identifiers such as hostname, target, project, and user-derived values to an external server.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script performs remote binary download plus tunnel registration to external endpoints without clearly warning that code will be fetched and executed and that project metadata/routing will be sent off-host. In an auto-triggered skill that promises zero-config exposure, lack of disclosure materially increases user risk.

Session Persistence

Medium

• Category: Rogue Agent

Content

local runner="$1"
  local pid_file="$2"
  local log_file="$3"
  nohup "${runner}" >>"${log_file}" 2>&1 &
  echo $! >"${pid_file}"
}

• Confidence: 89% confidence
• Finding: The script uses nohup/background execution with PID files to keep the app and agent running after invocation, and it additionally persists machine-level state under ~/.tunneling. In a skill that auto-triggers to expose projects publicly, this persistence can outlive user intent and leave services reachable longer than expected.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The skill advertises exposing the current project, but the script creates a persistent machine-wide tunnel and agent under ~/.tunneling and reuses them across projects and sessions. This broadens scope beyond the user's apparent request, creates cross-project coupling, and can unintentionally expose or retain routing state for other local projects.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script builds the project, starts commands, and kills existing processes as part of restart logic without an explicit warning or confirmation. In this skill context, automatic execution and termination increase the risk of surprising destructive behavior on the user's machine.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script advertises fully automatic project detection and tunnel startup, but it also accepts and forwards arbitrary extra arguments such as custom start commands and scripts to the downstream launcher. In an auto-triggered skill, this expands behavior from simple automation into arbitrary command execution paths that are not disclosed in the manifest, increasing the chance of unexpected or unsafe process execution.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script copies a helper executable into the target project directory without disclosing that side effect in the skill description. Writing executables into user projects can alter repository state, confuse users, and create persistence or trust-boundary issues if the file is later run, committed, or mistaken for project-owned code.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This skill autonomously writes a new executable file into the user's project with no warning or confirmation. In the context of a skill that auto-triggers on natural-language requests, silent workspace modification is risky because it creates unexpected files and executable content inside a trusted codebase.