T03 · Remote Payload Retrieval and Execution
Error
- Location
assets/project-tunnel.sh:521- Finding
Unverified Mutable Native Binary Is Downloaded and Executed
- Content
View full analysis
"${MACHINE_AGENT_RUNNER}" <- Remediation
View remediation
Security audit
一键内网穿透
Security checks for vulnerabilities and agentic risk
Overview
This skill creates public project URLs as advertised, but it also automatically changes the host, downloads executable code, and leaves background tunnel state that users should review first.
Install only if you are comfortable with a skill that can expose local projects to the public internet, install system packages, download and run a third-party native agent, keep shared tunnel state under your home directory, and stop local processes by port. Review or patch the scripts first if you need explicit consent, HTTPS/WSS control channels, verified binaries, or reliable cleanup.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/fix_env.sh:15- Finding
Mutable Homebrew Installer Is Downloaded Directly Into a Shell
- Content
View full analysis
/dev/null 2>&1; then echo "[fix] installing Homebrew first..." /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" fi case "$tool" in python3) brew install python3 ;; node|npm) brew install node ;; curl) brew install curl ;; lsof) echo "[fix] lsof is part of macOS base — reinstall Xcode CLI tools:" && xcode-select --install ;; *) brew install "$tool" ;; esac } ``` This function is reached automatically from `scripts/auto_start.sh:57-64`: ```bash ENV_OUT="$("${SCRIPT_DIR}/check_env.sh" 2>&1)" || true if echo "${ENV_OUT}" | grep -q "❌"; then MISSING="$(echo "${ENV_OUT}" | sed 's/.*missing: //')" echo "[auto] fixing environment: ${MISSING}" # shellcheck disable=SC2086 "${SCRIPT_DIR}/fix_env.sh" ${MISSING} fi ``` ### Technical Analysis The script retrieves the Homebrew installation script from the mutable `HEAD` branch and immediately passes its contents to `/bin/bash -c`. There is no opportunity to inspect the downloaded content and no pinned commit, checksum, or signature validation. The source is the official Homebrew GitHub repository, not a pastebin. Nevertheless, executing the mutable branch directly creates a supply-chain code-execution boundary. The Skill's autonomous workflow makes this more serious because environment repair is performed without presenting the command or requesting approval. ### Attack Path 1. A required command is absent on macOS and Homebrew is not installed. 2. `auto_start.sh` detects the missing dependency and invokes `fix_env.sh`. 3. `fix_env.sh` retrieves the current content of Homebrew's `HEAD/install.sh`. 4. A compromised upstream repository, account, delivery path, or changed ...[truncated 633 chars]- Remediation
View remediation
T06 · System Persistence
Error
- Location
assets/project-tunnel.sh:829- Finding
Machine-Wide Tunnel Agent Remains Running After the Documented Stop Operation
- Content
View full analysis
>"${log_file}" 2>&1 & echo $! >"${pid_file}" } ``` The documented `stop` path only references per-project process files and ports: ```bash if [[ "${cmd}" == "stop" ]]; then if [[ -f "${STATE_FILE}" ]]; then stop_tunnel_id="$(state_get tunnel_id || true)" stop_hostname="$(state_get hostname || true)" stop_target="$(state_get target || true)" if [[ -z "${stop_target}" ]]; then stop_target="${TARGET}" fi if [[ -n "${stop_tunnel_id}" && -n "${stop_hostname}" ]]; then stop_payload="$($PYTHON - "${stop_tunnel_id}" "${stop_hostname}" "${stop_target}" <<'PY' import json import sys tunnel_id, hostname, target = sys.argv[1:4] print(json.dumps({ "tunnel_id": tunnel_id, "hostname": hostname, "target": target, "enabled": False, })) PY )" api_post "${CONTROL_API_BASE}/api/routes" "${stop_payload}" >/dev/null || true fi fi stop_by_pid_file "${APP_PID_FILE}" stop_by_pid_file "${AGENT_PID_FILE}" stop_by_tcp_port "${PROJECT_PORT}" stop_by_tcp_port "${AGENT_ADMIN_PORT}" echo "[OK] stopped: ${PROJECT_KEY}" exit 0 fi ``` Machine-agent state is initialized only after that branch: ```bash MACHINE_DIR="${HOME}/.tunneling" MACHINE_ID_FILE="${MACHINE_DIR}/machine_id" MACHINE_STATE_FILE="${MACHINE_DIR}/machine_state.json" MACHINE_AGENT_DIR="${MACHINE_DIR}/machine-agent" MACHINE_AGENT_LOG="${MACHINE_AGENT_DIR}/agent.log" MACHINE_AGENT_PID="${MACHINE_AGENT_DIR}/agent.pid" MACHINE_AGENT_CONFIG="${MACHINE_AGENT_DIR}/config.json" MACHINE_AGENT_RUNNER="${MACHINE_AGENT_DIR}/run-agent.sh" MACHINE_ ...[truncated 1726 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
assets/project-tunnel.sh:712- Finding
Tunnel Credentials and Control Messages Use Plaintext Network Protocols
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/fix_env.sh:31- Finding
Autonomous Tunnel Startup Performs Privileged System Package Installation
- Content
View full analysis
/dev/null 2>&1; then case "$tool" in python3) sudo apt-get install -y python3 ;; node|npm) sudo apt-get install -y nodejs npm ;; curl) sudo apt-get install -y curl ;; lsof) sudo apt-get install -y lsof ;; *) sudo apt-get install -y "$tool" ;; esac elif command -v yum >/dev/null 2>&1; then case "$tool" in python3) sudo yum install -y python3 ;; node|npm) sudo yum install -y nodejs npm ;; curl) sudo yum install -y curl ;; lsof) sudo yum install -y lsof ;; *) sudo yum install -y "$tool" ;; esac else echo "❌ unknown package manager — please install '$tool' manually" >&2 exit 1 fi } ``` Automatic invocation occurs during normal startup: ```bash ENV_OUT="$("${SCRIPT_DIR}/check_env.sh" 2>&1)" || true if echo "${ENV_OUT}" | grep -q "❌"; then MISSING="$(echo "${ENV_OUT}" | sed 's/.*missing: //')" echo "[auto] fixing environment: ${MISSING}" # shellcheck disable=SC2086 "${SCRIPT_DIR}/fix_env.sh" ${MISSING} fi ``` ### Technical Analysis A request to expose a project can cause the Skill to invoke `sudo apt-get` or `sudo yum` and install packages globally. The `-y` flag suppresses package-manager confirmation, while the Skill instructions explicitly direct autonomous execution without user interaction. System-wide installation is broader than necessary for tunneling an already-running local port. Installing Node.js and npm is a project-runtime assumption rather than a strict tunnel requirement. Package installation can also execute maintainer lifecycle scripts with elevated privileges. The wildcard package branch is not directly exposed to a ...[truncated 1105 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
assets/project-tunnel.sh:583- Finding
Startup and Stop Logic Can Terminate Unrelated Processes by Port Number
- Content
View full analysis
/dev/null 2>&1 || true sleep 1 if is_pid_running "${pid}"; then kill -9 "${pid}" >/dev/null 2>&1 || true fi fi } ``` The function is called during normal startup before launching the application and agent: ```bash echo "[3/5] restart local app + ensure machine agent" stop_by_pid_file "${APP_PID_FILE}" stop_by_tcp_port "${PROJECT_PORT}" start_runner "${APP_RUNNER}" "${APP_PID_FILE}" "${APP_LOG}" # Machine-agent: start only if not already running if is_machine_agent_running; then echo "[machine-agent] already running (pid=$(cat "${MACHINE_AGENT_PID}" 2>/dev/null || echo '?'))" else echo "[machine-agent] starting..." write_machine_agent_runner "${TUNNEL_ID}" "${TUNNEL_TOKEN}" # Stop any stale process on the admin port stop_by_tcp_port "${MACHINE_AGENT_ADMIN_PORT}" start_runner "${MACHINE_AGENT_RUNNER}" "${MACHINE_AGENT_PID}" "${MACHINE_AGENT_LOG}" fi ``` ### Technical Analysis The Skill identifies the first process listening on a TCP port using `lsof` and terminates it without verifying that the process was launched by this Skill. It first sends a normal termination signal and then escalates to `SIGKILL`. Possession of a port is not proof of process identity. A user-selected port, an incorrectly detected port, or the fixed machine-agent port can already belong to an unrelated application. The process ownership restrictions imposed by the operating system limit which PIDs the current user can kill, but any same-user process is at risk. ### Attack Path 1. An unrelated process owned by the same user listens on the selected project p ...[truncated 844 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (40)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Copying or writing scripts into a user's project directory without clearly declaring that behavior is a meaningful integrity risk, especially when combined with shell execution and automation. Users may unknowingly end up with modified project contents or wrapper scripts that later execute with trust they did not intentionally grant.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Copying or writing scripts into a user's project directory without clearly declaring that behavior is a meaningful integrity risk, especially when combined with shell execution and automation. Users may unknowingly end up with modified project contents or wrapper scripts that later execute with trust they did not intentionally grant.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Copying or writing scripts into a user's project directory without clearly declaring that behavior is a meaningful integrity risk, especially when combined with shell execution and automation. Users may unknowingly end up with modified project contents or wrapper scripts that later execute with trust they did not intentionally grant.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Copying or writing scripts into a user's project directory without clearly declaring that behavior is a meaningful integrity risk, especially when combined with shell execution and automation. Users may unknowingly end up with modified project contents or wrapper scripts that later execute with trust they did not intentionally grant.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Copying or writing scripts into a user's project directory without clearly declaring that behavior is a meaningful integrity risk, especially when combined with shell execution and automation. Users may unknowingly end up with modified project contents or wrapper scripts that later execute with trust they did not intentionally grant.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrases include common requests like '启动项目' and 'start my project,' which can unintentionally invoke internet exposure and environment-changing behavior when a user may only want a local dev server. Because the skill's context is public exposure and automation, broad triggers materially raise the risk of accidental activation and unconsented external access.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill description does not prominently warn that it may expose a local project to the public internet and automatically install or change system packages. In this context, omission is especially dangerous because users may disclose internal apps or data externally and permit host modifications without informed consent.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill is designed to autonomously detect a project, start it, repair the environment, and expose it via a public URL, all without a user-facing warning about system and network consequences. This is dangerous because it can execute local code, install or modify dependencies, and publish a potentially sensitive development service to the internet without informed consent.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh Default behavior (zero-config): - PROJECT_DIR: current directory - PROJECT_NAME: package.json.name or current folder name - PROJECT_PORT: .tunnel-port > .env.local/.env PORT= > 3000 - USER_ID: current system user - SUBDOMAIN: <project>-<user> - DOMAIN_MODE: fixed (stable domain)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The cleanup logic kills processes by persisted PID files and by whatever process is currently listening on a port, including sibling-state cleanup and restart paths. If ports or PID files are stale or collide with unrelated services, the script can terminate unrelated local applications, causing denial of service or data loss.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script downloads an executable agent from GitHub at runtime and immediately marks it executable for later execution, without signature or checksum verification. This creates a supply-chain execution path not disclosed by the skill description, allowing compromise if the release source, network path, or repository is tampered with.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh if [[ -f "${PROJECT_DIR}/.tunnel-port" ]]; then PROJECT_PORT="$(head -n1 "${PROJECT_DIR}/.tunnel-port" | tr -d '[:space:]')" else PROJECT_PORT="$(port_from_file "${PROJECT_DIR}/.env.local" || true)" if [[ -z "${PROJECT_PORT}" ]]; then PROJECT_PORT="$(port_from_file "${PROJECT_DIR}/.env" || true)" fi
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh else PROJECT_PORT="$(port_from_file "${PROJECT_DIR}/.env.local" || true)" if [[ -z "${PROJECT_PORT}" ]]; then PROJECT_PORT="$(port_from_file "${PROJECT_DIR}/.env" || true)" fi PROJECT_PORT="${PROJECT_PORT:-3000}" fi
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises and instructs shell execution, file reads/writes, and environment modification, but declares no tool scope or permission boundaries. This creates an authorization gap where an agent could perform filesystem and command actions without explicit limitation or user-visible consent, increasing the chance of unsafe execution.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction requires replying with only
✅ 公网地址：<public_url>, which forces a Chinese response regardless of the user's language or locale. This is a natural-language policy issue because no opt-in or language choice is provided, and earlier instructions/examples mix English and Chinese user inputs.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 97% confidence
- Finding
The instruction to avoid asking the user for input unless port detection fails removes an important human checkpoint before high-impact actions are taken. In context, the autonomous behavior includes shell script execution, environment modification, and external network exposure, making the lack of confirmation materially unsafe.
- Content
yaml scripts/auto_start.sh . 3000 --startsh scripts/dev.sh # custom start script If auto_start.sh fails due to missing tools, run scripts/fix_env.sh <missing>, then retry. Never ask the user for input unless the port truly cannot be detected. policy: allow_implicit_invocation: true
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest explicitly enables implicit invocation without narrowly defined trigger constraints, allowing the skill to run based on broad natural-language phrases. In this skill, implicit execution is especially risky because invocation leads to network exposure and process/environment changes, so accidental or ambiguous triggers could expose a local project without clear user confirmation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The script sends JSON payloads to a remote control API to create/update routes and tunnels, which is necessary for the feature but still constitutes external transmission. In this context, the transmission is security-relevant because it enables public exposure of local services and sends identifiers such as hostname, target, project, and user-derived values to an external server.
- Content
sh local body_file body_file="$(mktemp)" local status status="$(curl -sS -o "${body_file}" -w "%{http_code}" -X POST "${url}" \ -H "Content-Type: application/json" \ --data "${payload}")" if ((status < 200 || status >= 300)); then
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script performs remote binary download plus tunnel registration to external endpoints without clearly warning that code will be fetched and executed and that project metadata/routing will be sent off-host. In an auto-triggered skill that promises zero-config exposure, lack of disclosure materially increases user risk.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 89% confidence
- Finding
The script uses nohup/background execution with PID files to keep the app and agent running after invocation, and it additionally persists machine-level state under ~/.tunneling. In a skill that auto-triggers to expose projects publicly, this persistence can outlive user intent and leave services reachable longer than expected.
- Content
sh local runner="$1" local pid_file="$2" local log_file="$3" nohup "${runner}" >>"${log_file}" 2>&1 & echo $! >"${pid_file}" }
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill advertises exposing the current project, but the script creates a persistent machine-wide tunnel and agent under ~/.tunneling and reuses them across projects and sessions. This broadens scope beyond the user's apparent request, creates cross-project coupling, and can unintentionally expose or retain routing state for other local projects.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script builds the project, starts commands, and kills existing processes as part of restart logic without an explicit warning or confirmation. In this skill context, automatic execution and termination increase the risk of surprising destructive behavior on the user's machine.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script advertises fully automatic project detection and tunnel startup, but it also accepts and forwards arbitrary extra arguments such as custom start commands and scripts to the downstream launcher. In an auto-triggered skill, this expands behavior from simple automation into arbitrary command execution paths that are not disclosed in the manifest, increasing the chance of unexpected or unsafe process execution.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script copies a helper executable into the target project directory without disclosing that side effect in the skill description. Writing executables into user projects can alter repository state, confuse users, and create persistence or trust-boundary issues if the file is later run, committed, or mistaken for project-owned code.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This skill autonomously writes a new executable file into the user's project with no warning or confirmation. In the context of a skill that auto-triggers on natural-language requests, silent workspace modification is risky because it creates unexpected files and executable content inside a trusted codebase.
- Content