ClawHub
Back to skill

Security audit

Tandemn Tuna Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent GPU deployment helper, but users should treat it as cloud-infrastructure tooling that can create costs, expose endpoints, and destroy deployments.

Install and run this in an isolated environment where possible, pin package versions if your workflow requires reproducibility, use least-privilege cloud/API credentials, avoid --public except for controlled testing, monitor cloud costs, and check tuna list/status before running destroy commands, especially --all.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding
Unpinned Third-Party Packages Create a Supply-Chain Execution Risk## Vulnerability Details **File Location**: `SKILL.md:13-16`, `SKILL.md:28-30`, `SKILL.md:158-201` **Vulnerability Type**: Unpinned and unverifiable third-party dependencies **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:13-16`: ```yaml install: - kind: uv package: tandemn-tuna bins: [tuna] ``` `SKILL.md:28-30`: ```bash # 1. Install tuna uv pip install tandemn-tuna ``` `SKILL.md:158-164`: ```bash pip install modal # or: uv pip install tandemn-tuna[modal] modal token new # opens browser to authenticate ``` `SKILL.md:174-179`: ```bash pip install google-cloud-run # or: uv pip install tandemn-tuna[cloudrun] gcloud auth login gcloud auth application-default login ``` `SKILL.md:184-188`: ```bash pip install truss # or: uv pip install tandemn-tuna[baseten] export BASETEN_API_KEY="your-api-key" truss login --api-key $BASETEN_API_KEY ``` `SKILL.md:192-196`: ```bash pip install azure-mgmt-appcontainers azure-identity # or: uv pip install tandemn-tuna[azure] az login az provider register --namespace Microsoft.App az provider register --namespace Microsoft.OperationalInsights ``` `SKILL.md:200-201`: ```bash pip install cerebrium # or: uv pip install tandemn-tuna[cerebrium] cerebrium login ``` ### Technical Analysis The Skill directs users or agents to install multiple packages from a public package index using mutable package names. It does not specify exact versions, cryptographic hashes, signed artifacts, a lockfile, or another reproducible verification mechanism. The project contains only documentation and metadata; it does not include the source code of the installed `tandemn-tuna` command or provider dependencies. Consequently, the effective executable behavior cannot be verified from the audited artifact. A compromised package account, dependency-confusion condition, malicious transitive dependency, or compromised future r ...[truncated 1922 chars]
Remediation
## Remediation Suggestions 1. Pin every direct package to an exact, reviewed version rather than accepting the latest available release. 2. Provide a lockfile that records all resolved transitive dependency versions. 3. Require cryptographic hashes for downloaded artifacts, such as through a hash-locked requirements file. 4. Verify package signatures or release provenance where supported and document the canonical source repository and publisher identity. 5. Generate and publish a software bill of materials for the complete dependency graph. 6. Review dependency updates before changing pinned versions and use automated vulnerability and package-integrity scanning. 7. Install and execute deployment tooling in an isolated virtual environment or container under a non-privileged operating-system account. 8. Authenticate with dedicated, least-privilege cloud identities scoped only to the resources and operations required for deployment. 9. Avoid exposing unrelated credentials to the installation or execution environment, and rotate relevant credentials if package integrity is ever in doubt.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Content
tuna deploy --model Qwen/Qwen3-0.6B --gpu L4 --service-name my-llm

# 3. Query your endpoint (shown in deploy output)
curl http://<router-ip>:8080/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{"model": "Qwen/Qwen3-0.6B", "messages": [{"role": "user", "content": "Hello!"}]}'
```
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill documents a `--public` option that exposes an inference endpoint without authentication, but it does not warn users that this can enable unauthorized model access, abuse, prompt/data leakage, or unexpected cost accrual. In the context of GPU-backed public APIs, unauthenticated exposure is especially risky because it can be discovered and abused quickly.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill presents destructive commands such as `tuna destroy --all` without any caution that they will tear down live infrastructure and may cause service disruption or data/configuration loss. Users may copy-paste these commands during troubleshooting or cleanup without realizing the full blast radius.

Static analysis

No suspicious patterns detected.