Ogp Expose

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:34 AM UTC
• Version: 0.6.0

Overview

The skill is coherent for exposing OGP, but it includes persistent public tunnel and privileged install instructions that should be reviewed before use.

Install only if you intend to expose OGP to the internet. Prefer a temporary tunnel for testing, or a named authenticated tunnel for production. Before enabling launchd/systemd persistence, confirm OGP authentication, pin and verify installed binaries, avoid unnecessary sudo/global installs, and document how to stop and remove the service.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

• Location: SKILL.md:311

Finding

Persistent Public Tunnel Through a macOS LaunchAgent

Content

View full analysis

Label com.ogp.tunnel ProgramArguments /usr/local/bin/cloudflared tunnel --url http://localhost:18790 RunAtLoad KeepAlive ``` Load the service: ```bash launchctl load ~/Library/LaunchAgents/com.ogp.tunnel.plist ``` ### Technical Analysis The LaunchAgent invokes `cloudflared` automatically at user login and directs it to expose the local service on port `18790`. The `RunAtLoad` setting starts the tunnel without another explicit command, while `KeepAlive` causes launchd to restart it after termination. This creates cross-session persistence and a durable external route to a service that would otherwise only be reachable through localhost. Persistent registration is not necessary for the Skill's temporary or ad hoc tunnel functionality and therefore exceeds the minimum privileges and lifetime required for that workflow. Although the LaunchAgent runs in the affected user's context rather than as root, it survives the original Skill session and continues to expose the service until explicitly unloaded and removed. ### Attack Path 1. The user follows the documented instructions and creates the LaunchAgent property list. 2. The user runs `launchctl load`, registering the agent with launchd. 3. Launchd executes `/usr/local/bin/cloudflared` and exposes `http://localhost:18790` through a public tunnel. 4. `KeepAlive` restarts ...[truncated 809 chars]

Remediation

View remediation

T06 · System Persistence

Error

• Location: SKILL.md:341

Finding

Boot-Persistent Public Tunnel Through a Linux systemd Service

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:109

Finding

Unverified Download and Privileged Installation of a Mutable Cloudflared Binary

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (14)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest trigger uses broad natural-language conditions like 'user wants to expose their OGP daemon to the internet' and 'get a public URL for federation' without defining narrower invocation phrases, exclusions, or negative examples. In a markdown/manifest context, this can cause unintended activation because the scope is described conceptually rather than with specific trigger constraints.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

**Tunnels are optional — and often more private than alternatives.**

`ogp expose` can create a temporary public URL for your OGP daemon. This is one approach, not the only approach. You can expose your gateway however you prefer:

- **Named Cloudflare tunnel / stable HTTPS hostname** (preferred) — long-lived canonical URL for federation
- **Cloudflared/ngrok temporary tunnel** — useful for ad hoc testing

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md

# Linux
wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64
sudo mv cloudflared-linux-amd64 /usr/local/bin/cloudflared
sudo chmod +x /usr/local/bin/cloudflared

# Windows

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

# Linux
wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64
sudo mv cloudflared-linux-amd64 /usr/local/bin/cloudflared
sudo chmod +x /usr/local/bin/cloudflared

# Windows

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 310)May include surrounding context.

macOS (launchd)

Create ~/Library/LaunchAgents/com.ogp.tunnel.plist:

xml

<?xml version="1.0" encoding="UTF-8"?>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 314)May include surrounding context.

macOS (launchd)

Create ~/Library/LaunchAgents/com.ogp.tunnel.plist:

xml

<?xml version="1.0" encoding="UTF-8"?>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 315)May include surrounding context.

macOS (launchd)

Create ~/Library/LaunchAgents/com.ogp.tunnel.plist:

xml

<?xml version="1.0" encoding="UTF-8"?>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 331)May include surrounding context.

macOS (launchd)

Create ~/Library/LaunchAgents/com.ogp.tunnel.plist:

xml

<?xml version="1.0" encoding="UTF-8"?>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 336)May include surrounding context.

macOS (launchd)

Create ~/Library/LaunchAgents/com.ogp.tunnel.plist:

xml

<?xml version="1.0" encoding="UTF-8"?>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 314)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 336)May include surrounding context.

Load the service:

bash

launchctl load ~/Library/LaunchAgents/com.ogp.tunnel.plist

Linux (systemd)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 360)May include surrounding context.

Enable and start:

bash

sudo systemctl enable ogp-tunnel
sudo systemctl start ogp-tunnel

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 361)May include surrounding context.

Enable and start:

bash

sudo systemctl enable ogp-tunnel
sudo systemctl start ogp-tunnel

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 360)May include surrounding context.

Enable and start:

bash

sudo systemctl enable ogp-tunnel
sudo systemctl start ogp-tunnel

Static analysis

No suspicious patterns detected.