ClawHub
Back to skill

Security audit

Sshtunnel

Security checks across malware telemetry and agentic risk

Overview

This skill is openly for publishing SSH access through a tunnel, but it exposes a powerful admin service with under-scoped safety controls and includes unsafe install and TLS examples.

Review carefully before installing. Use this only for a machine you intend to expose, prefer pip/uv over remote script installers, require key-only SSH with strong access controls, avoid disabling TLS verification, keep the tunnel temporary, and undo any SSH or remote-login service changes when finished.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill explicitly recommends `curl ... | bash` and `irm ... | iex` installation flows, which execute remote code immediately without review, signature verification, or integrity checks. In a security-sensitive skill that opens network access, this materially increases supply-chain risk because a compromised server, DNS path, or hosting account could lead to arbitrary code execution on the user's machine.

Missing User Warnings

High
Confidence
99% confidence
Finding
The skill's core purpose is exposing a local SSH server to the public internet, but the description and opening guidance do not prominently warn about the security consequences of making SSH publicly reachable. This can lead users or agents to expose administrative access from behind NAT/firewalls without understanding brute-force, credential theft, misconfiguration, or unintended service exposure risks.

Ssd 3

High
Confidence
100% confidence
Finding
The Python example disables TLS hostname verification and certificate validation with `check_hostname = False` and `verify_mode = ssl.CERT_NONE`. That permits man-in-the-middle interception of the outer TLS tunnel, undermining the claimed trust model and potentially exposing SSH credentials, session contents, and remote command traffic to an attacker posing as the tunnel endpoint.

External Script Fetching

High
Category
Supply Chain
Content
## CLI Reference

The `aitun` command (installed via `pip install aitun`, or alternatively `curl -fsSL https://aitun.cc/install.sh | bash` / `irm https://aitun.cc/install.ps1 | iex` on Windows) accepts these flags:

| Flag | Description |
|---|---|
Confidence
97% confidence
Finding
curl -fsSL https://aitun.cc/install.sh | bash

VirusTotal

44/44 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.