Aitun Tunnel

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:22 AM UTC
• Version: 4.0.5

Overview

This skill has a coherent tunneling purpose, but it includes unsafe installer commands and can expose sensitive local services to the public internet without strong guidance.

Install only if you are comfortable with a third-party tunneling tool making chosen local services publicly reachable. Prefer the pip/uv path over curl-to-bash or irm-to-iex, review the package source/provenance where possible, avoid forwarding SSH/RDP/database/admin/debug ports, and stop any tunnel or daemon when sharing is no longer needed.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:53

Finding

Unverified Remote Installation Scripts Are Executed Directly

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:53-60, repeated at SKILL.md:134
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: Critical

Vulnerable Code

bash

Or install via one-line script (Linux/macOS):
```bash
curl -fsSL https://aitun.cc/install.sh | bash

text

```powershell
Windows (PowerShell):
```powershell
irm https://aitun.cc/install.ps1 | iex

text

The same installation methods are repeated in the CLI reference:

```markdown
The `aitun` command (installed via `pip install aitun`, or alternatively `curl -fsSL https://aitun.cc/install.sh | bash` / `irm https://aitun.cc/install.ps1 | iex` on Windows) accepts these flags:

Technical Analysis

The Linux/macOS command downloads mutable content from an external server and sends it directly to Bash. The Windows equivalent retrieves remote content and passes it directly to Invoke-Expression. In both cases, the fetched payload is executed without being stored for inspection, pinned to a reviewed version, or checked using a cryptographic hash or signature.

HTTPS protects the network transport but does not establish the integrity or continued trustworthiness of the script publisher. The effective installation payload can change after this Skill has been reviewed. A compromise of the website, DNS resolution, publishing infrastructure, or account controlling the domain could consequently turn an ordinary installation into arbitrary local code execution.

These methods exceed the minimum behavior necessary for the declared tunneling functionality because the document already provides package-manager installation alternatives. Nothing in the declared functionality requires an unaudited remote script to be executed directly.

Attack Path

1. An agent follows the installation instructions in SKILL.md.
2. The agent requests https://aitun.cc/install.sh or `https://aitun.cc/install.p ...[truncated 1102 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both direct execution patterns:
   • curl ... | bash
   • irm ... | iex
2. Prefer an audited package-manager installation pinned to an exact version.
3. If an installation script must be provided:
   • Download it to a local file without executing it.
   • Pin it to a versioned, immutable release URL.
   • Publish and verify a SHA-256 or stronger cryptographic checksum.
   • Prefer a verifiable code-signing mechanism.
   • Require inspection and explicit user approval before execution.
4. Never request root or administrator execution unless a documented installation operation strictly requires it.
5. Host release artifacts through a transparent release process and document their provenance.
6. Update the repeated CLI-reference text at line 134 so the unsafe alternatives are not reintroduced elsewhere in the Skill.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Third-Party Package Installation Is Not Version-Pinned or Integrity-Verified

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:18-23 and SKILL.md:48-51
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: pip
    package: aitun
    bins: [aitun]
  - kind: uv
    package: aitun
    bins: [aitun]

bash

### Step 1: Install aitun

```bash
pip install aitun

text

### Technical Analysis

The package name is specified without an exact version, package hash, trusted index restriction, or documented artifact provenance. Each installation can therefore resolve to whatever release is current at that time rather than the release reviewed alongside Skill version `4.0.5`.

Python package installation may execute package-controlled build logic, and the installed application itself executes package-controlled runtime code. If the package publisher, package-index account, distribution infrastructure, or a future release is compromised, agents following these instructions could install code different from the reviewed implementation.

The audit does not establish that the current `aitun` package is malicious. The vulnerability is the absence of controls ensuring that future installations retrieve the intended and reviewed artifact.

### Attack Path

1. An attacker compromises the relevant package publishing account or release process, or an unsafe future release is published under the same package name.
2. An agent runs `pip install aitun` or the framework processes the unpinned metadata entry.
3. The package resolver selects the new, uncontrolled release.
4. Package-controlled code runs during installation, invocation, or both.
5. The code acts with the permissions and data access available to the agent user.

### Impact Assessment

A compromised dependency can execute code under the installing user's account. It could access user-readable files, project data, environment variables, and network resource
...[truncated 347 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact reviewed version, consistently in both metadata and shell instructions.
2. Use cryptographic package hashes and an installation mode such as pip's --require-hashes.
3. Maintain a reviewed lock file or equivalent reproducible dependency manifest where supported.
4. Explicitly identify the trusted package index instead of relying on implicit resolver configuration.
5. Verify that the pinned package version corresponds to the version tested with this Skill.
6. Review package provenance, maintainership, build configuration, and transitive dependencies before publishing updates.
7. Update pins deliberately after security review rather than automatically installing the latest release.

other

Warning

• Location: SKILL.md:143

Finding

TCP Forwarding Exposes Sensitive Services Beyond the Declared HTTP Scope

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:3, SKILL.md:29-43, SKILL.md:143, and SKILL.md:151
Vulnerability Type: Excessive network exposure capability
Risk Level: Medium

Vulnerable Code

The declared purpose focuses on web pages and HTTP services:

yaml

description: Expose local web pages and HTTP services to the public internet via secure tunnels. Perfect for AI agents that build websites locally and need to share them publicly.

The CLI reference additionally documents forwarding arbitrary TCP services, including sensitive examples:

markdown

| `--tcp-ports PORTS` | TCP forwarding ports, comma-separated (e.g., `22,3306`; requires `-k`). Use without `-p` for TCP-only mode |

markdown

- The `-p` flag is optional. Omit it when using `--tcp-ports` only (TCP-only mode, e.g., SSH/RDP forwarding without HTTP)

Technical Analysis

The Skill's stated use cases concern sharing websites, local HTTP services, webhooks, and local APIs. The additional TCP forwarding feature is substantially broader: it can forward administrative protocols and database services such as SSH on port 22, RDP, and MySQL on port 3306.

Such forwarding is not required to fulfill the declared HTTP tunneling workflow. Administrative and database ports carry greater risk because they may expose authentication interfaces or sensitive services beyond the local machine. Although the documentation states that TCP forwarding requires a token, it does not provide a confirmation gate, port allowlist, service-specific safety checks, or prominent warnings against forwarding sensitive interfaces.

Attack Path

1. An agent or user follows the CLI reference instead of limiting the tunnel to the intended HTTP port.
2. The agent invokes aitun with --tcp-ports for SSH, RDP, a database, or another sensitive local service.
3. The tunneling provider establishes an externally reachable route to that service.

...[truncated 879 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --tcp-ports guidance from this HTTP-focused Skill.
2. If TCP forwarding must remain available, move it into a separate Skill with an explicit high-risk purpose and stronger safeguards.
3. Require explicit, informed user confirmation before forwarding any non-HTTP port.
4. Deny or strongly warn on commonly sensitive ports, including SSH, RDP, database, cache, and local administration ports.
5. Add a configurable allowlist of approved ports and local destinations.
6. Require users to confirm that the target service has strong authentication, current security patches, and no default credentials.
7. Document the tunnel's accessibility model and recommend firewall restrictions or source allowlisting where supported.
8. Limit tunnel duration and ensure cleanup occurs reliably after the intended task.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill recommends piping a remotely fetched script directly into bash, which executes unreviewed code from the network with the user's privileges. If the hosting site, transport, or upstream script is compromised, this becomes immediate arbitrary code execution on the local machine.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

Or install via one-line script (Linux/macOS):

bash

curl -fsSL https://aitun.cc/install.sh | bash

Windows (PowerShell):

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The documented command chains network retrieval directly into shell execution, eliminating any review boundary and making compromise of the remote content immediately exploitable. In a skill intended for autonomous or semi-autonomous agent use, this is especially risky because the agent may execute the chain automatically without human inspection.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

Or install via one-line script (Linux/macOS):

bash

curl -fsSL https://aitun.cc/install.sh | bash

Windows (PowerShell):

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 60% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

bash

# Check availability
curl -s https://aitun.cc/aitun-api/subdomain/check/myapp

# Register via website: https://aitun.cc
# Then use your token:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill repeatedly instructs the agent to publish local services to the public internet but does not give clear safety guidance about authentication, data exposure, access control, or the risk of exposing development servers. In an agent context, this omission is dangerous because users may unknowingly publish internal or unauthenticated services to anyone on the internet.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is presented as a way to expose local web pages and HTTP services, but the documented CLI also supports arbitrary TCP forwarding such as SSH, RDP, and database ports. That broadens the capability from simple web sharing to remote exposure of sensitive internal services, which materially changes the risk profile and can lead an agent to expose high-value services without recognizing the danger.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 15% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

bash

# Check availability
curl -s https://aitun.cc/aitun-api/subdomain/check/myapp

# Register via website: https://aitun.cc
# Then use your token: