ClawHub

tunelo

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says, but it can publish local files or services to the internet too easily and installs through an unverified remote shell script.

Install only if you trust tunelo.net and are comfortable with the remote installer. Use it only for files and services you intentionally want reachable from the internet, prefer --private or --local, avoid broad folders such as home or Documents, verify the exact path or port before sharing, and stop the tunnel when finished.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The skill’s trigger guidance is broad enough that an agent may invoke internet exposure based on casual phrases like 'share this' or 'send me the link' without first confirming that the user understands a public URL will be created. In this skill’s context, that is dangerous because its primary action exposes localhost services or local files to external access, which can unintentionally disclose sensitive data or internal apps.

Missing User Warnings

High
Confidence
96% confidence
Finding
The description emphasizes convenience but does not prominently warn that using the skill creates public internet reachability for local services and files. Because the skill is designed for AI agents and may be auto-invoked from natural-language requests, the missing warning materially increases the chance of accidental exposure of sensitive localhost endpoints, development systems, or private files.

External Script Fetching

High
Category
Supply Chain
Content
## Install

```bash
curl -fsSL https://tunelo.net/install.sh | sh
```

If `tunelo` is not found after install, the binary is at `/usr/local/bin/tunelo`.
Confidence
99% confidence
Finding
curl -fsSL https://tunelo.net/install.sh | sh

Chaining Abuse

High
Category
Tool Misuse
Content
## Install

```bash
curl -fsSL https://tunelo.net/install.sh | sh
```

If `tunelo` is not found after install, the binary is at `/usr/local/bin/tunelo`.
Confidence
98% confidence
Finding
| sh

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal