Sendfile

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:23 AM UTC
• Version: 1.0.5

Overview

The skill has a coherent file-sharing purpose, but its install and sharing instructions can expose more local content than intended and encourage unverified remote code execution.

Install only through a trusted, reviewed package source, avoid the one-line remote script installers, and use this skill only for non-sensitive files. Before sharing, place only the intended file in a dedicated temporary directory, bind the local server to loopback if possible, and shut down the tunnel immediately after download.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:53

Finding

Unverified Remote Installer Download and Immediate Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45-58 and 137
Vulnerability Type: Remote execution of mutable, unverified installation scripts
Risk Level: High

Vulnerable Code

bash

## Prerequisites

Install the aitun client (any one of):

# Install via pip (recommended, cross-platform, bundles the binary)
pip install aitun

# Or one-line install script (Linux/macOS)
curl -fsSL https://aitun.cc/install.sh | bash

# Windows (PowerShell)
irm https://aitun.cc/install.ps1 | iex

The unsafe commands are also repeated in the CLI documentation:

markdown

The `aitun` command (installed via `pip install aitun`, or alternatively `curl -fsSL https://aitun.cc/install.sh | bash` / `irm https://aitun.cc/install.ps1 | iex` on Windows) accepts these flags:

Technical Analysis

Both installation alternatives retrieve mutable content from an external server and pass it directly to a command interpreter. Neither command provides an opportunity to inspect the downloaded script before execution. The instructions do not require a cryptographic signature, pinned checksum, immutable version, or verified release artifact.

HTTPS protects the transport connection under normal conditions, but it does not establish that the current server-side script is the same script that was reviewed when the Skill was published. Compromise of the aitun.cc server, its deployment pipeline, DNS infrastructure, or signing credentials could therefore change the effective code executed by users without modifying this repository.

This behavior is not necessary for the declared file-sharing functionality. The metadata already supports package-manager-based installation, so immediate pipe-to-shell execution exceeds the minimum-risk installation mechanism required by the Skill.

Attack Path

1. An attacker compromises or otherwise gains control over the remote installer response at https://aitun.cc/install.sh or ...[truncated 1213 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the curl | bash and irm | iex installation methods from all locations in the document.
• Prefer installation from a trusted package registry using an explicitly pinned and audited version.
• If standalone installation scripts must remain available:
  1. Download the script to a local file without executing it.
  2. Publish a version-specific cryptographic checksum and detached signature through an independent trusted channel.
  3. Verify both the checksum and signature before execution.
  4. Require users to inspect the downloaded script.
  5. Execute it without administrative privileges unless a documented operation strictly requires elevation.
• Use immutable, versioned release URLs rather than a mutable install.sh or install.ps1 endpoint.
• Document the expected files, network access, and system changes made by the installer.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9-18, 45-49, and 137
Vulnerability Type: Unpinned dependency and insufficient supply-chain integrity controls
Risk Level: Medium

Vulnerable Code

yaml

metadata:
  openclaw:
    requires:
      bins:
        - python3
    envVars:
      - name: AITUN_SERVER
        required: false
        description: "AiTun server address (default: aitun.cc:6639)"
    install:
      - kind: pip
        package: aitun
        bins: [aitun]
      - kind: uv
        package: aitun
        bins: [aitun]

bash

# Install via pip (recommended, cross-platform, bundles the binary)
pip install aitun

Technical Analysis

The dependency declaration and installation command identify only the package name aitun; they do not specify an exact version or artifact hash. Consequently, installation resolves whichever package version the selected registry considers current at installation time.

The effective executable can change after this Skill has been audited. A compromised package-maintainer account, malicious replacement release, registry compromise, or unintended breaking release could introduce unsafe installation or runtime behavior. The project contains no lockfile, vendored implementation, signature information, or hash-pinned requirements that would allow an auditor to connect the installed artifact to a specific reviewed version.

This finding concerns the lack of dependency integrity controls. The reviewed repository does not itself prove that the current aitun package is malicious.

Attack Path

1. An attacker compromises the relevant package publishing account or distribution channel.
2. The attacker publishes a malicious package version under the expected aitun name.
3. A user or automated installer processes package: aitun or runs pip install aitun.
4. The package manager selects the attacker-controlled rel ...[truncated 812 chars]

Remediation

View remediation

Remediation Suggestions

• Pin aitun to an exact version that has undergone security review.
• Require cryptographic hashes for the expected distribution artifacts, such as through a hash-locked requirements file.
• Ensure both pip and uv installation metadata resolve to the same reviewed release.
• Use an internal or otherwise trusted package mirror where appropriate.
• Record the package source, reviewed version, artifact hashes, and update procedure in the Skill documentation.
• Re-audit each dependency update before modifying the pinned version.
• Avoid installing dependencies with elevated privileges and use an isolated virtual environment where possible.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:84

Finding

Public Tunnel Exposes an Entire Directory Without Access Control

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 84-101 and 126-132
Vulnerability Type: Excessive file exposure and unsafe service lifecycle
Risk Level: High

Vulnerable Code

bash

### Step 2: Start a local file server

Start a simple HTTP server in the directory containing the file:

# If the file is at /path/to/output/report.pdf
cd /path/to/output
python3 -m http.server 8080 &
FILE_PID=$!
sleep 1

### Step 3: Create a tunnel

Use aitun to expose the local server to the internet:

aitun -p 8080 &
AITUN_PID=$!
sleep 3

Cleanup is conditional on a later user confirmation:

bash

### Step 6: Clean up

After the user confirms they have downloaded the file, stop the servers:

kill $AITUN_PID 2>/dev/null
kill $FILE_PID 2>/dev/null

Technical Analysis

python3 -m http.server serves the current directory rather than restricting access to the requested file. Its default handler also provides directory listings when an index file is absent. Therefore, every readable file and traversable subdirectory beneath /path/to/output may become available, not merely report.pdf.

The aitun process then publishes this HTTP service through an internet-accessible tunnel. The documented URL contains no recipient authentication, authorization check, one-time token, or per-file access policy. Anyone who obtains or discovers the tunnel URL may request the directory root, enumerate neighboring files, and download them.

The HTTP server also binds to all interfaces by default rather than explicitly binding to loopback. It may consequently be reachable from the local network independently of the tunnel.

Finally, cleanup occurs only after the user confirms a successful download. If the conversation is abandoned, the agent crashes, process identifiers are lost, or confirmation never arrives, both services may remain active longer than required. Although the notes claim th ...[truncated 1937 chars]

Remediation

View remediation

Remediation Suggestions

• Create a new temporary directory with restrictive permissions for each transfer.
• Copy only the intended file into that directory, using a sanitized filename.
• Never serve the file directly from a project, output, home, or shared directory containing unrelated content.
• Replace the directory-oriented HTTP handler with a single-file endpoint that rejects all other paths and disables directory listing.
• Bind the local server explicitly to loopback, for example:

  bash

  python3 -m http.server 8080 --bind 127.0.0.1
  

• Use an authenticated, high-entropy, single-use download token and expire it immediately after the first successful transfer.
• Apply an automatic short timeout independent of user confirmation.
• Install shell traps or equivalent lifecycle management so both processes are terminated on success, failure, interruption, or agent exit.
• Verify that the process identifiers still refer to the expected processes before terminating them.
• Delete the temporary serving directory after shutdown.
• Warn users that a public bearer URL can be accessed by anyone who possesses it and require explicit approval before sharing potentially sensitive files.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

curl -fsSL https://aitun.cc/install.sh | bash executes code directly from a remote server in a shell without prior inspection or verification. If the server, DNS, TLS trust chain, or distribution pipeline is compromised, the host running the skill can be fully compromised immediately.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

bash

# Or one-line install script (Linux/macOS)
curl -fsSL https://aitun.cc/install.sh | bash

powershell

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The | bash construct is a classic high-risk chaining pattern because it transforms fetched remote content directly into code execution with no review boundary. In agent or automation contexts, this is especially dangerous because it can be executed non-interactively and may inherit powerful credentials or filesystem access.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

bash

# Or one-line install script (Linux/macOS)
curl -fsSL https://aitun.cc/install.sh | bash

powershell

External Script Fetching

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Repeating the remote script execution pattern in the CLI reference reinforces unsafe installation behavior and normalizes execution of unverified network-fetched code. Even as reference text, it increases the chance that operators follow an insecure path leading to system compromise.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md

## CLI Reference

The `aitun` command (installed via `pip install aitun`, or alternatively `curl -fsSL https://aitun.cc/install.sh | bash` / `irm https://aitun.cc/install.ps1 | iex` on Windows) accepts these flags:

| Flag | Description |
|---|---|

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The installation instructions recommend one-line remote script execution for both Unix and Windows without any integrity verification or safety warning. This encourages users or agents to execute unreviewed code fetched over the network, creating a direct software supply-chain and remote code execution risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill tells the agent to run python3 -m http.server in the file's directory and expose it publicly through a tunnel, which makes the entire directory browsable and downloadable, not just the intended file. In an agent environment, this can unintentionally expose adjacent files, logs, generated artifacts, or secrets if the working directory is broader than expected.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.