Collab Edit

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:27 AM UTC
• Version: 1.0.6

Overview

This collaboration skill has a coherent purpose, but it should be reviewed because it recommends unsafe installers and exposes a public unauthenticated editor by default.

Before installing, avoid the one-line remote installer commands, use pinned and verified packages where possible, require authentication on any shared editor, bind services to 127.0.0.1 unless broader access is truly needed, restrict the shared workspace to non-sensitive files, and treat the public tunnel URL as a secret that should be closed when the session ends.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:47

Finding

Unverified Aitun Installation Scripts Are Executed Directly from the Internet

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:47-57 and repeated in SKILL.md:132
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable code:

bash

pip install aitun

Or install via one-line script (Linux/macOS):

bash

curl -fsSL https://aitun.cc/install.sh | bash

Windows (PowerShell):

powershell

irm https://aitun.cc/install.ps1 | iex

The same unsafe alternatives are repeated in the CLI reference:

text

The `aitun` command (installed via `pip install aitun`, or alternatively `curl -fsSL https://aitun.cc/install.sh | bash` / `irm https://aitun.cc/install.ps1 | iex` on Windows) accepts these flags:

Technical Analysis

Both installation alternatives download mutable content and send it directly to a command interpreter. Neither command pins an installer version, verifies a cryptographic digest or signature, nor gives the operator an opportunity to inspect the downloaded script before execution.

HTTPS protects the connection in transit but does not make the server content immutable or establish that every future version of the installer is safe. Compromise of aitun.cc, its deployment pipeline, DNS or TLS infrastructure, or an upstream dependency could therefore change the effective code executed after the Skill has already been reviewed.

Direct remote-script execution is not necessary for the declared collaboration functionality because the Skill already supports package-manager installation. The remote installers consequently exceed the minimum safe mechanism needed to obtain the tunnel client.

Attack Path

1. An agent follows the Skill's installation procedure.
2. An attacker compromises the installer host, publishing pipeline, or relevant delivery infrastructure.
3. The attacker replaces install.sh or install.ps1 with a malicious payload.
4. curl | bash or irm | iex passes that payload d ...[truncated 657 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the curl | bash and irm | iex installation alternatives.
• Install a specifically reviewed and pinned Aitun version through a trusted package registry.
• Use a lockfile and require published cryptographic hashes or verifiable signatures.
• If a standalone installer is unavoidable, download it to a file first, validate its digest and signature against an independently distributed value, inspect it, and only then execute it.
• Perform installation in an isolated, unprivileged environment rather than as an administrator or root user.
• Update the repeated CLI-reference text at line 132 so it does not continue recommending the unsafe commands.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:68

Finding

Code-Server Installer Is Downloaded and Executed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:68-73
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: High

Vulnerable code:

bash

# Option A: Code-server (VS Code in browser) for pair programming
# Install: curl -fsSL https://code-server.dev/install.sh | sh
code-server --bind-addr 0.0.0.0:8080 --auth none &
COLLAB_PID=$!

Technical Analysis

The documented installation command retrieves a mutable script from code-server.dev and immediately executes it with sh. There is no version pin, checksum, signature verification, or review step. Although shown as a commented installation instruction, it is explicitly presented to users and agents as the method for installing the required tool.

This creates a supply-chain execution channel whose effective payload can change independently of the audited Skill. Trust in HTTPS alone does not protect against a compromised website, release pipeline, signing environment, or malicious future installer revision.

Attack Path

1. An agent selects the code-server collaboration option.
2. It follows the documented installation command.
3. A compromised installer endpoint or release pipeline returns attacker-controlled shell code.
4. The pipe sends the content directly to sh.
5. The malicious script executes with the agent user's permissions before code-server is started.
6. The script can steal data, alter the workspace, or establish additional unauthorized execution mechanisms.

Impact Assessment

Exploitation permits arbitrary shell-command execution as the invoking user. The affected scope includes all files, credentials, processes, and network resources accessible to that account. Executing the instruction with administrative privileges could expand the impact to system-wide modification.

Remediation

View remediation

Remediation Suggestions

• Remove the pipe-to-shell installation instruction.
• Specify a reviewed, exact code-server release rather than an unbounded current installer.
• Use an operating-system package or downloaded release artifact with validated signatures and cryptographic hashes.
• Run code-server as a dedicated unprivileged account or inside a restricted container.
• Document the expected artifact digest and a safe, separate download-and-verification procedure.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:68

Finding

Unauthenticated Code Editor Is Exposed Through a Public Internet Tunnel

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:68-74 and SKILL.md:90-99
Vulnerability Type: Unsafe authentication and network-exposure configuration
Risk Level: High

Vulnerable code:

bash

# Option A: Code-server (VS Code in browser) for pair programming
# Install: curl -fsSL https://code-server.dev/install.sh | sh
code-server --bind-addr 0.0.0.0:8080 --auth none &
COLLAB_PID=$!

bash

aitun -p 8080 &
AITUN_PID=$!
sleep 3

text

The output will contain the public URL, e.g.:
- `https://aitun.cc/abc123`

Technical Analysis

The prescribed code-server configuration explicitly disables authentication with --auth none and binds the service to every local network interface using 0.0.0.0. The subsequent step exposes port 8080 through an Internet-accessible tunnel.

Possession of the generated URL therefore becomes the only practical access barrier. URLs can be disclosed through chat history, browser history, logs, screenshots, referrer data, accidental forwarding, or compromise of the tunnel service. A later note merely recommends considering authentication and does not correct the insecure default procedure.

Binding to all interfaces is also broader than required: a local tunnel client can normally connect to a loopback-bound service. The combination of wildcard binding, disabled authentication, and public tunneling violates least-privilege and secure-by-default principles.

Attack Path

1. The agent starts code-server on 0.0.0.0:8080 with authentication disabled.
2. The agent starts Aitun, creating a public route to that port.
3. The generated URL is leaked, logged, forwarded, observed, or otherwise obtained by an unauthorized party.
4. The attacker opens the URL without needing a password or identity check.
5. The attacker accesses the editor and any workspace made available to it.
6. Depending on enabled code-server features and workspace per ...[truncated 541 chars]

Remediation

View remediation

Remediation Suggestions

• Never expose code-server with --auth none.
• Require a strong, randomly generated per-session password, short-lived access token, or identity-aware proxy.
• Bind the collaboration service to 127.0.0.1:8080 unless there is a demonstrated need for broader local-network access.
• Configure the tunnel to target only the loopback service and only the required HTTP port.
• Restrict code-server to a dedicated workspace containing no unrelated secrets or repositories.
• Run the service as a dedicated unprivileged user or within a sandboxed container.
• Disable terminal access and unnecessary extensions or task execution where collaboration only requires editing.
• Treat the public URL as sensitive, expire it promptly, and verify that authentication is active before sharing it.
• Make authentication mandatory in the primary instructions rather than an optional note.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:78

Finding

Unpinned Third-Party Packages Are Installed and Executed at Runtime

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:47-48 and SKILL.md:78-88
Vulnerability Type: Unpinned and immediately executed third-party dependencies
Risk Level: Medium

Vulnerable code:

bash

pip install aitun

bash

# Option B: Hedgedoc / Etherpad-like tool for document collaboration
# (install per project instructions, then start on port 8080)

# Option C: Simple shared notepad (Python)
pip install collaborative-notepad
collaborative-notepad --port 8080 &
COLLAB_PID=$!

# Option D: Whiteboard (excalidraw self-hosted or similar)
npx excalidraw-room --port 8080 &
COLLAB_PID=$!

Technical Analysis

The package names are installed without exact versions, integrity hashes, or lockfiles. This allows package managers to resolve mutable current releases and transitive dependencies at installation time. Package installation may execute setup hooks, while the documented commands immediately run the resulting executables.

The npx command is particularly sensitive because it can retrieve a package from the registry and execute it in one operation. The Skill contains no reviewed source or dependency manifest establishing what code these packages and their transitive dependencies will execute.

This finding identifies unsafe dependency handling; the audited file does not independently establish that any named package is currently malicious.

Attack Path

1. An agent follows one of the documented collaboration setup options.
2. The package manager resolves the latest package and dependency versions available at that time.
3. A compromised registry account, package release, or transitive dependency supplies malicious code.
4. Installation hooks run during pip install, or npx retrieves and executes the compromised package.
5. The package executes with the permissions of the agent user.
6. It can access the workspace, user files, credentials, and network resourc ...[truncated 407 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to an exact reviewed version.
• Use dependency lockfiles and verify hashes for direct and transitive packages.
• Confirm package ownership, publisher identity, and registry provenance before recommending a dependency.
• Replace runtime npx retrieval with a pre-reviewed, pinned installation in an isolated environment.
• Disable package installation scripts where supported and not required.
• Install dependencies in a dedicated virtual environment or restricted container rather than the user's global environment.
• Regularly scan locked dependencies for known vulnerabilities and review updates before changing versions.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

curl -fsSL https://aitun.cc/install.sh | bash downloads and immediately executes a remote script in the shell. This is a classic arbitrary code execution pattern that transfers full trust to the remote endpoint and any infrastructure in between.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

Or install via one-line script (Linux/macOS):

bash

curl -fsSL https://aitun.cc/install.sh | bash

Windows (PowerShell):

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The | bash construct is a chaining pattern that turns a network fetch directly into code execution with no inspection boundary. This magnifies the impact of any compromise of the source or transit path into immediate system-level execution.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

Or install via one-line script (Linux/macOS):

bash

curl -fsSL https://aitun.cc/install.sh | bash

Windows (PowerShell):

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

curl -fsSL https://code-server.dev/install.sh | sh has the same remote-code-execution risk: the fetched script executes immediately with the user's privileges. In an agent-skill context, this is particularly risky because users or agents may run the command non-interactively and without review.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

bash

# Option A: Code-server (VS Code in browser) for pair programming
# Install: curl -fsSL https://code-server.dev/install.sh | sh
code-server --bind-addr 0.0.0.0:8080 --auth none &
COLLAB_PID=$!

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The | sh chaining pattern similarly converts remote content into immediate execution, making compromise or tampering instantly exploitable. In a skill intended for convenient setup, such guidance can normalize unsafe operational behavior.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

bash

# Option A: Code-server (VS Code in browser) for pair programming
# Install: curl -fsSL https://code-server.dev/install.sh | sh
code-server --bind-addr 0.0.0.0:8080 --auth none &
COLLAB_PID=$!

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The CLI reference repeats the remote script execution pattern, reinforcing unsafe installation guidance. Repetition increases the likelihood that users adopt the insecure method instead of the safer package-based alternative.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

## CLI Reference

The `aitun` command (installed via `pip install aitun`, or alternatively `curl -fsSL https://aitun.cc/install.sh | bash` / `irm https://aitun.cc/install.ps1 | iex` on Windows) accepts these flags:

| Flag | Description |
|---|---|

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The installation instructions recommend executing remote scripts directly from the network without any safety warning, verification step, or trust guidance. This exposes users to arbitrary code execution if the upstream server, CDN, DNS, or delivery path is compromised.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions explicitly start code-server bound to 0.0.0.0 with --auth none, then expose it through a public tunnel. This can give anyone with the link direct access to a live editing environment, enabling unauthorized viewing or modification of sensitive content and potentially broader compromise depending on the tool's capabilities.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The skill invokes npx excalidraw-room without pinning a specific package version, which can pull whatever the latest published package is at execution time. That creates a supply-chain risk and makes builds non-reproducible, especially dangerous in an agent skill that may be run automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to share a public collaboration URL without first warning that exposed editors may permit unauthorized access or edits when authentication is disabled or omitted. In this context, the omission materially increases the chance that users expose sensitive files or sessions insecurely.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Claiming that 'all traffic is encrypted end-to-end' overstates the security guarantees of the described setup. Users may rely on that statement and expose sensitive material under the false assumption that no intermediate tunnel service can observe plaintext or metadata beyond standard transport protection.

Content

No source excerpt is available for this finding.