ClawHub
Back to skill

Security audit

Tandemn Tuna Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent GPU deployment helper, but users should treat it as cloud-infrastructure tooling that can create costs, expose endpoints, and destroy deployments.

Install and run this in an isolated environment where possible, pin package versions if your workflow requires reproducibility, use least-privilege cloud/API credentials, avoid --public except for controlled testing, monitor cloud costs, and check tuna list/status before running destroy commands, especially --all.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Third-Party Packages Create a Supply-Chain Execution Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:13-16, SKILL.md:28-30, SKILL.md:158-201
Vulnerability Type: Unpinned and unverifiable third-party dependencies
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:13-16:

yaml
install:
  - kind: uv
    package: tandemn-tuna
    bins: [tuna]

SKILL.md:28-30:

bash
# 1. Install tuna
uv pip install tandemn-tuna

SKILL.md:158-164:

bash
pip install modal  # or: uv pip install tandemn-tuna[modal]
modal token new    # opens browser to authenticate

SKILL.md:174-179:

bash
pip install google-cloud-run  # or: uv pip install tandemn-tuna[cloudrun]
gcloud auth login
gcloud auth application-default login

SKILL.md:184-188:

bash
pip install truss  # or: uv pip install tandemn-tuna[baseten]
export BASETEN_API_KEY="your-api-key"
truss login --api-key $BASETEN_API_KEY

SKILL.md:192-196:

bash
pip install azure-mgmt-appcontainers azure-identity  # or: uv pip install tandemn-tuna[azure]
az login
az provider register --namespace Microsoft.App
az provider register --namespace Microsoft.OperationalInsights

SKILL.md:200-201:

bash
pip install cerebrium  # or: uv pip install tandemn-tuna[cerebrium]
cerebrium login

Technical Analysis

The Skill directs users or agents to install multiple packages from a public package index using mutable package names. It does not specify exact versions, cryptographic hashes, signed artifacts, a lockfile, or another reproducible verification mechanism.

The project contains only documentation and metadata; it does not include the source code of the installed tandemn-tuna command or provider dependencies. Consequently, the effective executable behavior cannot be verified from the audited artifact. A compromised package account, dependency-confusion condition, malicious transitive dependency, or compromised future r ...[truncated 1922 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct package to an exact, reviewed version rather than accepting the latest available release.
  2. Provide a lockfile that records all resolved transitive dependency versions.
  3. Require cryptographic hashes for downloaded artifacts, such as through a hash-locked requirements file.
  4. Verify package signatures or release provenance where supported and document the canonical source repository and publisher identity.
  5. Generate and publish a software bill of materials for the complete dependency graph.
  6. Review dependency updates before changing pinned versions and use automated vulnerability and package-integrity scanning.
  7. Install and execute deployment tooling in an isolated virtual environment or container under a non-privileged operating-system account.
  8. Authenticate with dedicated, least-privilege cloud identities scoped only to the resources and operations required for deployment.
  9. Avoid exposing unrelated credentials to the installation or execution environment, and rotate relevant credentials if package integrity is ever in doubt.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

tuna deploy --model Qwen/Qwen3-0.6B --gpu L4 --service-name my-llm

3. Query your endpoint (shown in deploy output)

curl http://:8080/v1/chat/completions
-H "Content-Type: application/json"
-d '{"model": "Qwen/Qwen3-0.6B", "messages": [{"role": "user", "content": "Hello!"}]}'

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill documents a --public option that exposes an inference endpoint without authentication, but it does not warn users that this can enable unauthorized model access, abuse, prompt/data leakage, or unexpected cost accrual. In the context of GPU-backed public APIs, unauthenticated exposure is especially risky because it can be discovered and abused quickly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill presents destructive commands such as tuna destroy --all without any caution that they will tear down live infrastructure and may cause service disruption or data/configuration loss. Users may copy-paste these commands during troubleshooting or cleanup without realizing the full blast radius.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.