Webhook Receiver

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:22 AM UTC
• Version: 1.0.7

Overview

The skill has a coherent webhook-tunnel purpose, but it should go to Review because it recommends unsafe installer execution and an insecure public webhook example.

Install only if you are comfortable reviewing the tunnel client installation path yourself. Prefer a pinned package or verified release, avoid pipe-to-shell installers, bind local handlers narrowly when possible, verify webhook signatures, and redact tokens, signatures, cookies, personal data, and payment details from logs.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:50

Finding

Unverified Remote Installer Scripts Are Executed Directly

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 50-57 and line 164
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

The installation instructions execute mutable scripts retrieved from aitun.cc directly in a shell.

bash

Or install via one-line script (Linux/macOS):
```bash
curl -fsSL https://aitun.cc/install.sh | bash

Windows (PowerShell):

powershell

irm https://aitun.cc/install.ps1 | iex

text

The unsafe alternatives are repeated in the CLI documentation:

```markdown
The `aitun` command (installed via `pip install aitun`, or alternatively `curl -fsSL https://aitun.cc/install.sh | bash` / `irm https://aitun.cc/install.ps1 | iex` on Windows) accepts these flags:

Technical Analysis

Piping curl output into bash, or passing an Internet response to PowerShell's Invoke-Expression, combines retrieval and execution into a single operation. The user cannot inspect the exact payload before it runs, and the Skill does not pin a script revision or require checksum or signature verification.

The effective executable payload can change after the Skill has been audited. Compromise of the domain, web server, DNS resolution, TLS endpoint, deployment pipeline, or installer publishing account could consequently turn the documented installation command into arbitrary code execution.

This behavior is not required for the declared webhook functionality. The Skill already supports package-manager installation, so remote script execution exceeds the minimum mechanism necessary to install the tunnel client.

Attack Path

1. An attacker compromises the remote installer, its publication infrastructure, or another component capable of controlling the HTTPS response.
2. The attacker modifies install.sh or install.ps1 to contain a malicious payload.
3. A user or agent follows the installation instructions in SKILL.md.
4. curl or irm ret ...[truncated 696 chars]

Remediation

View remediation

Remediation Suggestions

• Remove all curl | bash and irm | iex installation alternatives, including the repeated commands in the CLI reference.
• Prefer a package-manager or release-artifact installation process that allows review before execution.
• Pin the installer or artifact to a specific audited version.
• Publish cryptographic checksums through an independent trusted channel and require verification before execution.
• Prefer signed release artifacts and verify the publisher's signature.
• Download installers to a local file, inspect them, and execute them only after successful integrity validation.
• Explicitly warn users not to run installation commands from an administrator or root shell unless elevated privileges are demonstrably necessary.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:12

Finding

Third-Party Tunnel Package Is Installed Without Version or Integrity Pinning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-18, line 47, and line 164
Vulnerability Type: Insecure dependency installation
Risk Level: High

The Skill metadata and installation instructions specify the aitun dependency without an exact version or integrity constraint.

yaml

install:
  - kind: pip
    package: aitun
    bins: [aitun]
  - kind: uv
    package: aitun
    bins: [aitun]

bash

pip install aitun

The same unpinned command is referenced again in the CLI documentation:

markdown

The `aitun` command (installed via `pip install aitun`, or alternatively `curl -fsSL https://aitun.cc/install.sh | bash` / `irm https://aitun.cc/install.ps1 | iex` on Windows) accepts these flags:

Technical Analysis

An unpinned package specification resolves to whichever package version the configured registry currently considers appropriate. The code installed in the future may therefore differ from the version that existed when this Skill was reviewed.

Python packages can execute code during installation or when their command-line entry points are invoked. The absence of an exact version and package hash prevents reliable reproduction and does not detect unauthorized changes to the downloaded distribution. The audit did not establish that the current aitun package is malicious; the vulnerability is the unsafe and mutable supply-chain dependency.

Attack Path

1. The package publisher account, package registry, release pipeline, or an authorized release environment is compromised.
2. A malicious or compromised version of aitun is published.
3. A user or agent executes pip install aitun, or the Skill framework processes the unpinned installation metadata.
4. The package manager resolves the dependency to the affected release.
5. Malicious code executes during installation or when the aitun command is started.

Impact Assessment

Exploitation can ...[truncated 361 chars]

Remediation

View remediation

Remediation Suggestions

• Pin aitun to an exact version that has been independently reviewed.
• Use a lock file or requirements file containing hashes for every accepted distribution.
• Install with hash enforcement, such as pip install --require-hashes -r requirements.txt.
• Ensure both the Skill metadata and manual installation instructions use the same pinned release.
• Review package ownership, release provenance, signatures, and dependency changes before updating the pin.
• Prefer isolated virtual environments rather than system-wide installation.
• Establish a controlled update process that performs security review before accepting newer releases.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:66

Finding

Public Webhook Example Accepts Unauthenticated Requests and Logs Sensitive Content

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 66-104 and line 185
Vulnerability Type: Unauthenticated webhook processing and sensitive-data logging
Risk Level: High

The example handler reads an attacker-declared body length, accepts requests without signature verification, and logs complete headers and request bodies.

python

# webhook_handler.py
from http.server import HTTPServer, BaseHTTPRequestHandler
import json

class WebhookHandler(BaseHTTPRequestHandler):
    def do_POST(self):
        content_length = int(self.headers['Content-Length'])
        body = self.rfile.read(content_length)
        try:
            data = json.loads(body)
        except Exception:
            data = body.decode()

        print(f"Received webhook at {self.path}")
        print(f"Headers: {dict(self.headers)}")
        print(f"Body: {data}")

        self.send_response(200)
        self.send_header('Content-Type', 'application/json')
        self.end_headers()
        self.wfile.write(json.dumps({"status": "ok"}).encode())

    def do_GET(self):
        # Useful for verification endpoints
        self.send_response(200)
        self.send_header('Content-Type', 'application/json')
        self.end_headers()
        self.wfile.write(json.dumps({"status": "alive"}).encode())

if __name__ == '__main__':
    server = HTTPServer(('0.0.0.0', 8080), WebhookHandler)
    print("Webhook handler listening on port 8080")
    server.serve_forever()

The notes explicitly reinforce unrestricted logging:

markdown

- For debugging, log the full request headers and body before processing

Technical Analysis

The tunnel makes the handler reachable from the Internet, but the example performs no provider-specific signature, shared-secret, token, timestamp, or replay verification. Any party able to reach or discover the URL can submit a request that is treated as a successfully rec ...[truncated 1968 chars]

Remediation

View remediation

Remediation Suggestions

• Require provider-specific webhook signature verification before parsing or acting on payloads.
• Store webhook secrets outside source code and retrieve them from protected environment or secret-management facilities.
• Validate timestamps and event identifiers to prevent replay attacks.
• Reject requests that omit Content-Length, use unsupported content types, or exceed a conservative maximum body size.
• Apply read timeouts and consider a server implementation with appropriate concurrency and resource controls.
• Do not log complete headers or bodies by default.
• Redact authorization headers, cookies, signatures, tokens, personal information, and provider-specific sensitive fields.
• Log only minimal metadata such as a validated event type, delivery identifier, timestamp, and processing result.
• Return an authentication error for invalid signatures rather than HTTP 200.
• Bind the handler to the minimum required interface. If the tunnel connects through localhost, prefer 127.0.0.1 over 0.0.0.0.
• Clearly label the example as development-only until authentication, validation, error handling, and resource limits are implemented.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

curl -fsSL https://aitun.cc/install.sh | bash is a classic arbitrary code execution pattern: untrusted remote content is streamed directly into a shell. This bypasses inspection and creates a single-step compromise path if the source or transport chain is tampered with. The skill context does not justify this pattern; safer installation methods are already available.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

Or install via one-line script (Linux/macOS):

bash

curl -fsSL https://aitun.cc/install.sh | bash

Windows (PowerShell):

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The | bash construct is dangerous because it chains network retrieval directly into command execution, eliminating any opportunity to inspect or validate the fetched content. This is effectively a one-line remote code execution primitive if the upstream content is altered. In an agent skill, such command patterns are particularly risky because they may be copied or automated verbatim.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

Or install via one-line script (Linux/macOS):

bash

curl -fsSL https://aitun.cc/install.sh | bash

Windows (PowerShell):

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The CLI reference repeats the unsafe remote-script execution pattern, normalizing direct execution of code fetched from the internet. Repetition increases the chance users or downstream agents will treat it as endorsed best practice and execute it without review. Because this is documentation for installation/usage, the unsafe pattern directly influences operator behavior.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md

## CLI Reference

The `aitun` command (installed via `pip install aitun`, or alternatively `curl -fsSL https://aitun.cc/install.sh | bash` / `irm https://aitun.cc/install.ps1 | iex` on Windows) accepts these flags:

| Flag | Description |
|---|---|

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs users to fetch and execute remote installer scripts directly via shell and PowerShell pipelines without verification, pinning, or integrity checks. If the remote host, CDN, DNS, TLS termination, or install script is compromised, arbitrary code executes immediately on the agent host. In a skill intended for agent automation, this is especially dangerous because users may run setup commands with minimal scrutiny.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly recommends logging full request headers and bodies for traffic received from a public internet-facing webhook endpoint. Webhooks commonly carry secrets, bearer tokens, signatures, personal data, or payment metadata, so indiscriminate logging can expose sensitive data to console logs, log aggregators, or later prompt context. The webhook-receiver context increases risk because the endpoint is intended for third-party callbacks from external services.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.