ClawHub
Back to skill

Security audit

Sshtunnel

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it publishes SSH access to the internet and includes unsafe installation and connection examples that users should review carefully.

Only install this if you intentionally want to expose an SSH server through aitun. Prefer a pinned, verified package installation over the one-line scripts, avoid running installers as root, use key-only SSH with password login disabled, use a least-privilege account, rotate any token placed on a command line, and stop the tunnel when finished.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:53
Finding

Unverified Remote Installation Scripts Are Executed Directly

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:16
Finding

Unpinned Third-Party Package Installation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:193
Finding

Example Disables TLS Certificate Validation and Omits SSH Host-Key Verification

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:102
Finding

Tunnel Authentication Token Is Passed Through Process Arguments

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

curl -fsSL https://aitun.cc/install.sh | bash fetches and executes remote code in a single step with no integrity verification, review, or pinning. If the server, CDN, DNS, TLS trust chain, or upstream script is compromised, users can execute attacker-controlled code immediately on their machine.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

Or install via one-line script (Linux/macOS):

bash
curl -fsSL https://aitun.cc/install.sh | bash

Windows (PowerShell):

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The | bash construct directly chains untrusted network content into shell execution, eliminating any opportunity for inspection or validation. This materially increases the blast radius of a compromise because a single malicious response results in arbitrary command execution.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

Or install via one-line script (Linux/macOS):

bash
curl -fsSL https://aitun.cc/install.sh | bash

Windows (PowerShell):

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md
ssh user@yourname.t.aitun.cc

# With SSH key
ssh -i ~/.ssh/id_rsa user@yourname.t.aitun.cc

# With verbose output for debugging
ssh -v user@yourname.t.aitun.cc

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 315)May include surrounding context.

md
ssh user@yourname.t.aitun.cc

# With SSH key
ssh -i ~/.ssh/id_rsa user@yourname.t.aitun.cc

# With verbose output for debugging
ssh -v user@yourname.t.aitun.cc

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

Repeating the pipe-to-shell install pattern in the CLI reference normalizes insecure software installation and increases the likelihood users will execute unverified remote code. This is especially risky in a skill that already deals with network exposure and privileged system setup.

Content

Scanner excerpt · SKILL.md (reported line 334)May include surrounding context.

md
## CLI Reference

The `aitun` command (installed via `pip install aitun`, or alternatively `curl -fsSL https://aitun.cc/install.sh | bash` / `irm https://aitun.cc/install.ps1 | iex` on Windows) accepts these flags:

| Flag | Description |
|---|---|

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill’s purpose is to expose a local SSH service to the public internet, but the description/front matter does not prominently warn users that this creates a remotely reachable login surface. In this context, omission of an upfront warning is dangerous because users may enable internet exposure without understanding risks like brute force attacks, credential compromise, or unintended access to an internal machine.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

bash
# Ubuntu/Debian
sudo apt install openssh-server -y
sudo systemctl start sshd

# CentOS/RHEL

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

bash
# Ubuntu/Debian
sudo apt install openssh-server -y
sudo systemctl start sshd

# CentOS/RHEL

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

bash
# Ubuntu/Debian
sudo apt install openssh-server -y
sudo systemctl start sshd

# CentOS/RHEL

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md
sudo systemctl start sshd

# CentOS/RHEL
sudo yum install openssh-server -y
sudo systemctl start sshd

# macOS (usually pre-installed)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
sudo systemctl start sshd

# CentOS/RHEL
sudo yum install openssh-server -y
sudo systemctl start sshd

# macOS (usually pre-installed)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The remote SSH examples show how to connect and run commands against the exposed host, but they do not directly warn that anyone with valid access can execute shell commands on the machine being exposed. Because this skill is specifically for remote shell access, the missing warning increases the chance that users expose sensitive systems without appreciating that they are granting command execution capability.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The Python example explicitly disables TLS hostname verification and certificate validation with check_hostname = False and verify_mode = ssl.CERT_NONE. That permits man-in-the-middle interception of the outer TLS layer, undermining the claimed SSH-over-TLS security guarantees and exposing SSH sessions to traffic interception or redirection to an attacker-controlled endpoint.

Content

No source excerpt is available for this finding.