ClawHub
Back to skill

Security audit

Rdptunnel

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it guides users to expose Remote Desktop to the internet with unsafe installer shortcuts and persistent/background access paths that need review before use.

Install only if you explicitly need to expose RDP and can harden it first. Prefer a pinned, verified aitun install over the one-line scripts, use strong credentials and NLA, restrict access where possible, run tunnels in visible foreground sessions for temporary use, and verify that RDP services, daemonized processes, ports, and tokens are stopped or revoked afterward.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:54
Finding

Unverified Remote Installation Scripts Are Executed Directly

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Third-Party Package Installation Creates Supply-Chain Exposure

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Warning
Location
SKILL.md:94
Finding

Persistent RDP Service and Background Tunnel Operation Can Outlive the Intended Session

Content
View full analysis
/tmp/rdp-bridge.log 2>&1 & ``` The CLI reference and notes additionally recommend daemon operation: ```text --daemon | Run as background daemon ``` ```text The tunnel stays active as long as the aitun process runs; use `--daemon` for persistent background operation on the server side ``` ### Technical Analysis `systemctl enable xrdp` configures the RDP service to start on later boots. This is unnecessary for a temporary support or demonstration session, where `systemctl start xrdp` is sufficient. Enabling it broadens the duration during which port 3389 may be reachable from local networks or any network permitted by the host firewall. The hidden PowerShell process, `nohup` process, and daemon mode can keep proxy or tunnel components active after the initiating terminal is closed. These mechanisms do not all guarantee reboot persistence, but they do make the access path less visible and allow it to outlive the interactive Skill invocation. The cleanup section only instructs users to terminate current tunnel and proxy processes. It doe ...[truncated 2321 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (13)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill’s description and opening content promote exposing RDP to the public internet but do not lead with a strong, explicit warning about the substantial attack surface this creates. Internet-facing RDP is a frequent target for brute force, credential stuffing, exploitation of RDP flaws, and unauthorized remote access, so presenting it as 'perfect' for agents materially understates the risk.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

curl -fsSL https://aitun.cc/install.sh | bash executes remote code directly in the shell without verification, creating a classic supply-chain/code-execution risk. If the remote server, script, DNS, or transport trust chain is compromised, the user will execute attacker-controlled commands immediately.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

Or install via one-line script (Linux/macOS):

bash
curl -fsSL https://aitun.cc/install.sh | bash

Windows (PowerShell):

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The | bash chain turns a network fetch into immediate command execution, removing any opportunity for inspection or validation. This amplifies the impact of compromise of the remote source and is a well-known dangerous pattern for initial access or arbitrary code execution.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

Or install via one-line script (Linux/macOS):

bash
curl -fsSL https://aitun.cc/install.sh | bash

Windows (PowerShell):

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

These instructions explicitly enable Remote Desktop on Windows and verify port 3389 listening, which changes the host’s security posture by turning on remote access. Without a prominent warning and gating conditions, a user may enable RDP on a machine that was intentionally not remotely accessible, increasing exposure to unauthorized access.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

Repeating the pipe-to-shell installation pattern in the CLI reference normalizes unsafe execution of fetched scripts and increases the chance users adopt it without scrutiny. This is especially risky in a skill that already deals with remote access tooling and privileged system changes.

Content

Scanner excerpt · SKILL.md (reported line 312)May include surrounding context.

md
## CLI Reference

The `aitun` command (installed via `pip install aitun`, or alternatively `curl -fsSL https://aitun.cc/install.sh | bash` / `irm https://aitun.cc/install.ps1 | iex` on Windows) accepts these flags:

| Flag | Description |
|---|---|

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The install section offers remote script execution via curl/iex patterns without an explicit warning about supply-chain and code-execution risk. Users are encouraged to run fetched code directly in a shell, which can lead to arbitrary code execution if the hosting site, path, DNS, TLS trust, or upstream content is compromised.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

bash
# Install xrdp
sudo apt install xrdp -y    # Debian/Ubuntu
sudo yum install xrdp -y    # CentOS/RHEL

# Start xrdp service

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

bash
# Install xrdp
sudo apt install xrdp -y    # Debian/Ubuntu
sudo yum install xrdp -y    # CentOS/RHEL

# Start xrdp service

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md
sudo yum install xrdp -y    # CentOS/RHEL

# Start xrdp service
sudo systemctl start xrdp
sudo systemctl enable xrdp

# Verify it is listening on port 3389

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md
sudo yum install xrdp -y    # CentOS/RHEL

# Start xrdp service
sudo systemctl start xrdp
sudo systemctl enable xrdp

# Verify it is listening on port 3389

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

systemctl enable xrdp makes the remote desktop service persist across reboots, which prolongs exposure and can leave internet-accessible remote access active long after the user intended. In a skill specifically about tunneling RDP outward, persistence materially increases the chance of forgotten exposure and unauthorized access.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md
# Start xrdp service
sudo systemctl start xrdp
sudo systemctl enable xrdp

# Verify it is listening on port 3389
ss -tlnp | grep :3389

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The guidance to run aitun tcp-proxy in the background encourages a long-lived bridge process that can quietly continue exposing access paths after the user forgets about it. In the context of public RDP connectivity, background persistence increases operational risk even if the author’s intent appears convenience-focused rather than malicious.

Content

Scanner excerpt · SKILL.md (reported line 296)May include surrounding context.

text

```bash
# Linux/macOS: nohup
nohup aitun tcp-proxy -l 13389 yourname.aitun.cc 3389 >/tmp/rdp-bridge.log 2>&1 &

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

Using nohup ... & creates a detached long-running proxy that may survive terminal closure and remain available unnoticed. Because this skill is intended to facilitate remote desktop access over the internet, hidden persistence raises the chance of unintended continued exposure.

Content

Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.

bash
# Linux/macOS: nohup
nohup aitun tcp-proxy -l 13389 yourname.aitun.cc 3389 >/tmp/rdp-bridge.log 2>&1 &

Security Recommendations