Rdptunnel

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:27 AM UTC
• Version: 4.9.23

Overview

The skill does what it says, but it guides users to expose Remote Desktop to the internet with unsafe installer shortcuts and persistent/background access paths that need review before use.

Install only if you explicitly need to expose RDP and can harden it first. Prefer a pinned, verified aitun install over the one-line scripts, use strong credentials and NLA, restrict access where possible, run tunnels in visible foreground sessions for temporary use, and verify that RDP services, daemonized processes, ports, and tokens are stopped or revoked afterward.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:54
• Finding: Unverified Remote Installation Scripts Are Executed Directly<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 54-61; repeated at line 312 **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High ### Vulnerable Code ```bash Or install via one-line script (Linux/macOS): ```bash curl -fsSL https://aitun.cc/install.sh | bash ``` Windows (PowerShell): ```powershell irm https://aitun.cc/install.ps1 | iex ``` ``` The same unsafe alternatives are repeated in the CLI reference: ```text The `aitun` command (installed via `pip install aitun`, or alternatively `curl -fsSL https://aitun.cc/install.sh | bash` / `irm https://aitun.cc/install.ps1 | iex` on Windows) accepts these flags: ``` ### Technical Analysis The Linux and macOS command pipes an HTTP response directly into `bash`, while the Windows command sends the downloaded response directly to PowerShell's `Invoke-Expression` alias. Neither workflow: - Pins the installer to an immutable release. - Verifies a cryptographic checksum or digital signature. - Saves the script for review before execution. - Constrains the commands or resources available to the installer. - Prevents the remote payload from changing after the Skill has been reviewed. HTTPS provides transport protection but does not guarantee that the hosting server, DNS configuration, publication account, or installer supply chain will remain trustworthy. The effective code being executed is controlled by the remote endpoint at installation time. This behavior is not minimally necessary for RDP tunneling because the documentation already provides a package-based installation method. Even that method should be pinned and verified, but it avoids explicitly piping an arbitrary HTTP response into a command interpreter. ### Attack Path 1. An attacker compromises `aitun.cc`, its hosting account, DNS configuration, TLS issuance path, or installer publication workflow. 2. The attacker replaces `install.sh` or `install.ps1` with a malicious payload. 3. A ...[truncated 995 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all `curl | bash` and `irm | iex` installation instructions. 2. Publish versioned, immutable release artifacts through a verifiable release channel. 3. Require users to download the artifact separately before executing it. 4. Publish a SHA-256 or stronger checksum through an independent trusted channel and require verification before installation. 5. Digitally sign release artifacts and document signature verification using a pinned signing identity. 6. Pin the documented installer and client to a reviewed version rather than retrieving a mutable default installer. 7. Recommend installation from a non-administrative shell unless elevated privileges are demonstrably required. 8. If an installer script must be offered, use a workflow similar to: ```bash curl -fSLo install.sh https://example.invalid/releases/v4.9.23/install.sh echo "EXPECTED_SHA256 install.sh" | sha256sum --check - less install.sh bash install.sh ``` The real documentation must provide an authentic expected digest and trusted URL rather than the placeholders above. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13
• Finding: Unpinned Third-Party Package Installation Creates Supply-Chain Exposure<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 13-18 and 49-51; also referenced at line 312 **Vulnerability Type**: Unpinned and unverified dependency installation **Risk Level**: Medium ### Vulnerable Code The Skill metadata requests an unversioned package: ```yaml install: - kind: pip package: aitun bins: [aitun] - kind: uv package: aitun bins: [aitun] ``` The installation instructions likewise install the current package selected by the configured package index: ```bash pip install aitun ``` ### Technical Analysis Although the text recommends version 4.9.23, neither the metadata nor the installation command enforces that version. No package hashes, signed lock file, index restriction, or artifact signature is supplied. As a result, the code installed during a future invocation may differ from the version reviewed when this Skill was published. Package installation and later execution both provide a code-execution path. The risk is amplified because the package implements a network tunnel and receives an authentication token through `-k`, giving a compromised dependency access to sensitive tunnel credentials and network traffic. There is no evidence in the audited file that the current `aitun` package is malicious. The confirmed issue is the absence of dependency pinning and integrity controls. ### Attack Path 1. An attacker compromises the package publisher account, package repository, release process, or a package index configured on the target host. 2. The attacker publishes a malicious package version that resolves under the unpinned name `aitun`. 3. A user or agent installs the Skill or runs `pip install aitun`. 4. The package manager downloads the attacker-controlled release because no exact version or hash is required. 5. Malicious code executes during package installation or when the `aitun` command is invoked. 6. The package can access the invoking user's files and environment, capture the tunnel ...[truncated 650 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency metadata and command to the exact reviewed release: ```yaml - kind: pip package: aitun==4.9.23 bins: [aitun] ``` ```bash python3 -m pip install 'aitun==4.9.23' ``` 2. Use a hash-locked requirements file and require package hash verification: ```text aitun==4.9.23 --hash=sha256:VERIFIED_RELEASE_HASH ``` 3. Obtain the actual digest from a trusted release process and never use an illustrative or unverified hash. 4. Explicitly specify the trusted package index and prevent fallback to untrusted private or mirror indexes where practical. 5. Prefer signed release artifacts and verify the publisher identity. 6. Review each dependency update before changing the pinned version. 7. Install into an isolated virtual environment under a non-administrative account. 8. Avoid passing secrets in command-line arguments when the client supports a protected environment variable, file descriptor, or restricted configuration file. ]]>

T06 · System Persistence

Warning

• Location: SKILL.md:94
• Finding: Persistent RDP Service and Background Tunnel Operation Can Outlive the Intended Session<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 94-99; related background execution at lines 270-282 and daemon guidance at lines 326-327 and 340 **Vulnerability Type**: Persistent service enablement and concealed background network processes **Risk Level**: Medium ### Vulnerable Code The Linux setup enables xrdp at system startup: ```bash # Start xrdp service sudo systemctl start xrdp sudo systemctl enable xrdp # Verify it is listening on port 3389 ss -tlnp | grep :3389 ``` The Skill also recommends hidden or detached proxy processes: ```powershell # Windows: start in a new window, minimized start /min cmd /c "aitun tcp-proxy -l 13389 yourname.aitun.cc 3389" # Or use PowerShell Start-Process Start-Process -WindowStyle Hidden -FilePath "aitun" -ArgumentList "tcp-proxy","-l","13389","yourname.aitun.cc","3389" ``` ```bash # Linux/macOS: nohup nohup aitun tcp-proxy -l 13389 yourname.aitun.cc 3389 >/tmp/rdp-bridge.log 2>&1 & ``` The CLI reference and notes additionally recommend daemon operation: ```text --daemon | Run as background daemon ``` ```text The tunnel stays active as long as the aitun process runs; use `--daemon` for persistent background operation on the server side ``` ### Technical Analysis `systemctl enable xrdp` configures the RDP service to start on later boots. This is unnecessary for a temporary support or demonstration session, where `systemctl start xrdp` is sufficient. Enabling it broadens the duration during which port 3389 may be reachable from local networks or any network permitted by the host firewall. The hidden PowerShell process, `nohup` process, and daemon mode can keep proxy or tunnel components active after the initiating terminal is closed. These mechanisms do not all guarantee reboot persistence, but they do make the access path less visible and allow it to outlive the interactive Skill invocation. The cleanup section only instructs users to terminate current tunnel and proxy processes. It doe ...[truncated 2321 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `sudo systemctl enable xrdp` from the default workflow. Use only: ```bash sudo systemctl start xrdp ``` 2. Present boot persistence, daemon mode, `nohup`, minimized windows, and hidden processes as explicit opt-in features with prominent security warnings. 3. Default both tunnel endpoints to visible foreground processes that terminate when the session ends. 4. Add complete Linux cleanup instructions: ```bash sudo systemctl stop xrdp sudo systemctl disable xrdp ``` 5. Document commands to identify and terminate detached `aitun` processes and verify that ports 3389 and 13389 are no longer listening. 6. Ensure daemon mode has a documented and reliable `--stop` procedure, and verify termination after invoking it. 7. Require Network Level Authentication, strong unique credentials, account lockout controls, and narrowly scoped RDP user authorization. 8. Restrict RDP with host firewall rules to necessary interfaces and trusted source networks where possible. 9. Prefer time-limited tunnel authorization and revoke the tunnel token after temporary access ends. 10. Add a final cleanup checklist covering the RDP service, server-side tunnel, client-side bridge, listening ports, background processes, and stored authentication tokens. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (13)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill’s description and opening content promote exposing RDP to the public internet but do not lead with a strong, explicit warning about the substantial attack surface this creates. Internet-facing RDP is a frequent target for brute force, credential stuffing, exploitation of RDP flaws, and unauthorized remote access, so presenting it as 'perfect' for agents materially understates the risk.

External Script Fetching

High

• Category: Supply Chain

Content

Or install via one-line script (Linux/macOS):
```bash
curl -fsSL https://aitun.cc/install.sh | bash
```

Windows (PowerShell):

• Confidence: 99% confidence
• Finding: `curl -fsSL https://aitun.cc/install.sh | bash` executes remote code directly in the shell without verification, creating a classic supply-chain/code-execution risk. If the remote server, script, DNS, or transport trust chain is compromised, the user will execute attacker-controlled commands immediately.

Chaining Abuse

High

• Category: Tool Misuse

Content

Or install via one-line script (Linux/macOS):
```bash
curl -fsSL https://aitun.cc/install.sh | bash
```

Windows (PowerShell):

• Confidence: 98% confidence
• Finding: The `| bash` chain turns a network fetch into immediate command execution, removing any opportunity for inspection or validation. This amplifies the impact of compromise of the remote source and is a well-known dangerous pattern for initial access or arbitrary code execution.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: These instructions explicitly enable Remote Desktop on Windows and verify port 3389 listening, which changes the host’s security posture by turning on remote access. Without a prominent warning and gating conditions, a user may enable RDP on a machine that was intentionally not remotely accessible, increasing exposure to unauthorized access.

External Script Fetching

High

• Category: Supply Chain

Content

## CLI Reference

The `aitun` command (installed via `pip install aitun`, or alternatively `curl -fsSL https://aitun.cc/install.sh | bash` / `irm https://aitun.cc/install.ps1 | iex` on Windows) accepts these flags:

| Flag | Description |
|---|---|

• Confidence: 98% confidence
• Finding: Repeating the pipe-to-shell installation pattern in the CLI reference normalizes unsafe execution of fetched scripts and increases the chance users adopt it without scrutiny. This is especially risky in a skill that already deals with remote access tooling and privileged system changes.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The install section offers remote script execution via curl/iex patterns without an explicit warning about supply-chain and code-execution risk. Users are encouraged to run fetched code directly in a shell, which can lead to arbitrary code execution if the hosting site, path, DNS, TLS trust, or upstream content is compromised.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Install xrdp
sudo apt install xrdp -y    # Debian/Ubuntu
sudo yum install xrdp -y    # CentOS/RHEL

# Start xrdp service

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Install xrdp
sudo apt install xrdp -y    # Debian/Ubuntu
sudo yum install xrdp -y    # CentOS/RHEL

# Start xrdp service

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo yum install xrdp -y    # CentOS/RHEL

# Start xrdp service
sudo systemctl start xrdp
sudo systemctl enable xrdp

# Verify it is listening on port 3389

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo yum install xrdp -y    # CentOS/RHEL

# Start xrdp service
sudo systemctl start xrdp
sudo systemctl enable xrdp

# Verify it is listening on port 3389

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Start xrdp service
sudo systemctl start xrdp
sudo systemctl enable xrdp

# Verify it is listening on port 3389
ss -tlnp | grep :3389

• Confidence: 90% confidence
• Finding: `systemctl enable xrdp` makes the remote desktop service persist across reboots, which prolongs exposure and can leave internet-accessible remote access active long after the user intended. In a skill specifically about tunneling RDP outward, persistence materially increases the chance of forgotten exposure and unauthorized access.

Session Persistence

Medium

• Category: Rogue Agent

Content

```

```bash
# Linux/macOS: nohup
nohup aitun tcp-proxy -l 13389 yourname.aitun.cc 3389 >/tmp/rdp-bridge.log 2>&1 &
```

• Confidence: 84% confidence
• Finding: The guidance to run `aitun tcp-proxy` in the background encourages a long-lived bridge process that can quietly continue exposing access paths after the user forgets about it. In the context of public RDP connectivity, background persistence increases operational risk even if the author’s intent appears convenience-focused rather than malicious.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# Linux/macOS: nohup
nohup aitun tcp-proxy -l 13389 yourname.aitun.cc 3389 >/tmp/rdp-bridge.log 2>&1 &
```

## Security Recommendations

• Confidence: 84% confidence
• Finding: Using `nohup ... &` creates a detached long-running proxy that may survive terminal closure and remain available unnoticed. Because this skill is intended to facilitate remote desktop access over the internet, hidden persistence raises the chance of unintended continued exposure.

Static analysis

No suspicious patterns detected.