Iot Bridge

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:23 AM UTC
• Version: 1.0.6

Overview

The skill does what it says, but it tells users to expose local IoT services to the internet and offers unsafe remote-script installation methods without enough safeguards.

Review this carefully before installing. Prefer a pinned, verified aitun package in an isolated environment, avoid the one-line remote script installers, and do not expose IoT dashboards, MQTT brokers, or device APIs unless authentication, TLS, access controls, and network segmentation are already in place.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:50

Finding

Mutable Remote Installers Are Downloaded and Executed Directly

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:50-58 and SKILL.md:141
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

markdown

Or install via one-line script (Linux/macOS):
```bash
curl -fsSL https://aitun.cc/install.sh | bash

Windows (PowerShell):

powershell

irm https://aitun.cc/install.ps1 | iex

text

The unsafe alternatives are repeated in the CLI reference at line 141:

```markdown
The `aitun` command (installed via `pip install aitun`, or alternatively `curl -fsSL https://aitun.cc/install.sh | bash` / `irm https://aitun.cc/install.ps1 | iex` on Windows) accepts these flags:

Technical Analysis

The documented commands retrieve mutable content from an external server and pass it directly to bash or PowerShell's Invoke-Expression. The downloaded payload is not displayed for inspection, pinned to a reviewed version, validated against a checksum, or authenticated with a cryptographic signature.

HTTPS protects the connection against ordinary in-transit modification but does not guarantee that the server, hosting account, DNS infrastructure, or published installer remains trustworthy. The effective code executed by the Skill user can therefore change after the Skill itself has been reviewed.

Direct remote shell execution is not necessary for the declared functionality. The document already provides a Python package installation method, so offering pipe-to-shell installation unnecessarily expands the supply-chain attack surface and gives the remote response all privileges held by the invoking user.

Attack Path

1. An attacker compromises or gains control over aitun.cc, its deployment infrastructure, DNS, or the installer publication process.
2. The attacker modifies install.sh or install.ps1 to include a malicious payload.
3. A user or agent follows the installation instructions in SKILL.md.
4. curl or ...[truncated 848 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | bash and irm | iex installation alternatives from both the installation section and CLI reference.
2. Prefer a version-pinned package installation from a verified publisher, performed inside a dedicated virtual environment.
3. If a standalone installer must be provided:
   • Publish immutable, versioned installer artifacts.
   • Download the installer to a local file rather than piping it into a shell.
   • Publish a SHA-256 digest through a separately protected release channel.
   • Verify the digest or a cryptographic signature before execution.
   • Allow users to inspect the downloaded script before running it.
4. Run installation with the least-privileged account and clearly state that users must not invoke it with sudo, root, or an elevated PowerShell session unless a documented operation specifically requires elevation.
5. Document what files, network endpoints, and configuration changes the installer performs.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned and Unverified Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:14-19, SKILL.md:45-48, and SKILL.md:141
Vulnerability Type: Insecure dependency management
Risk Level: Medium

Vulnerable Code

The Skill metadata declares the package without a fixed version:

yaml

install:
  - kind: pip
    package: aitun
    bins: [aitun]
  - kind: uv
    package: aitun
    bins: [aitun]

The manual installation instruction is also unpinned:

markdown

### Step 1: Install aitun

```bash
pip install aitun

text

The unpinned command is repeated at line 141:

```markdown
The `aitun` command (installed via `pip install aitun`, or alternatively `curl -fsSL https://aitun.cc/install.sh | bash` / `irm https://aitun.cc/install.ps1 | iex` on Windows) accepts these flags:

Technical Analysis

pip install aitun and the equivalent metadata resolve a package release at installation time without constraining it to a reviewed version or validating artifact hashes. Consequently, the dependency installed later may differ from the version considered when this Skill was audited.

Python packages may execute package-controlled code during installation or whenever their command-line entry points are invoked. This is especially sensitive here because the installed program is expected to access local service ports and establish an outbound tunnel to an external service.

No evidence in the reviewed file establishes that the package is currently malicious. The vulnerability is the absence of controls against a future compromised, replaced, or otherwise unsafe release.

Attack Path

1. An attacker compromises the package publisher account, package repository, release workflow, or an upstream dependency used by a future aitun release.
2. A malicious package version is published under the expected package name.
3. A user or automated Skill installer resolves aitun without a version constraint.
4. The mal ...[truncated 875 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specifically reviewed release in both installation metadata and user-facing commands, for example aitun==<reviewed-version>.
2. Require hashes for the exact distribution artifacts using a locked requirements file and pip install --require-hashes.
3. Record and verify the authoritative package index, publisher identity, source repository, and release-signing process.
4. Review every version update before changing the pin; do not use floating or broad version ranges for automated installation.
5. Install the package in an isolated virtual environment under a non-privileged account.
6. Apply network and filesystem restrictions appropriate for a tunneling client, and avoid exposing unauthenticated IoT services.
7. Use trusted dependency scanning and monitor the selected package and its transitive dependencies for compromised or vulnerable releases.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill recommends executing a remote installer script directly from the network via 'curl ... | bash', which bypasses normal review and integrity checks. If the remote host, CDN path, or transport chain is compromised, arbitrary code will run immediately on the user's machine with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

Or install via one-line script (Linux/macOS):

bash

curl -fsSL https://aitun.cc/install.sh | bash

Windows (PowerShell):

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The explicit chaining of downloaded content into 'bash' is a classic command-chaining antipattern that turns a network fetch directly into code execution. This removes any opportunity for inspection or validation and materially increases the blast radius of a compromised upstream installer.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

Or install via one-line script (Linux/macOS):

bash

curl -fsSL https://aitun.cc/install.sh | bash

Windows (PowerShell):

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The CLI reference repeats the unsafe recommendation to install via a remote shell script or PowerShell expression, reinforcing execution of unverified network content. Repetition increases the likelihood that users choose the most convenient but least safe path, resulting in arbitrary code execution risk.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md

## CLI Reference

The `aitun` command (installed via `pip install aitun`, or alternatively `curl -fsSL https://aitun.cc/install.sh | bash` / `irm https://aitun.cc/install.ps1 | iex` on Windows) accepts these flags:

| Flag | Description |
|---|---|

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly guides users to expose local IoT dashboards, brokers, and APIs to the public internet, but provides only a brief note to 'enable authentication' rather than a clear warning about the substantial risks: unauthorized device control, data leakage, and increased attack surface into the local network. In the IoT context, exposed services are especially sensitive because they may control physical devices or provide pivot points into home or industrial environments.

Content

No source excerpt is available for this finding.