Wcs Helper Network Skill

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:24 AM UTC
• Version: 1.0.1

Overview

This SSH tunnel skill has a clear purpose, but it handles SSH passwords and persistent network tunneling in ways users should review carefully before installing.

Install only on a machine you control and only if you are comfortable routing selected traffic through your own VPS. Prefer SSH keys or a secret manager over passwords, avoid pasting real passwords into chat or shell history, pin and review installer versions, and check for any systemd service or stored `~/.wcs_tunnel.conf` credential after use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: README.md:18
• Finding: Unpinned Third-Party Package Execution Through npx<![CDATA[ ## Vulnerability Details **File Location**: `README.md:18-21` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```bash ### Install ```bash npx -y clawhub install guanqi0914/wcs-helper-network-skill ``` ``` The same installation pattern also appears in `SKILL.md:90-93`. ### Technical Analysis The installation instructions invoke `clawhub` through `npx` without specifying a package version or integrity digest. The `-y` option suppresses the confirmation prompt, allowing `npx` to download and execute the currently resolved package automatically. Because neither the `clawhub` executable package nor the installed skill is pinned to a reviewed version, the effective code executed by this command may change after the documented project has been audited. Compromise of the relevant registry account, publication infrastructure, dependency chain, or package namespace could result in execution of attacker-controlled installation logic. ### Attack Path 1. An attacker compromises the package publisher, registry account, package namespace, or a transitive dependency used by the package resolved as `clawhub`. 2. The attacker publishes a malicious package version. 3. A user follows the documented installation command. 4. `npx -y` retrieves the currently resolved version without an interactive confirmation. 5. Malicious package lifecycle or CLI code executes with the privileges of the user performing the installation. 6. The malicious code can access files, credentials, network resources, and agent configuration available to that user. ### Impact Assessment Successful exploitation provides arbitrary code execution under the installing user's account. The practical scope depends on how installation is performed. If run as `root`, as suggested by the hard-coded `/root/.openclaw` path elsewhere in the project, compromise could affect the entire host. Potential consequences include credential theft, skill ...[truncated 88 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the executable package to a specifically reviewed version, for example `npx -y clawhub@<audited-version>`. - Pin the installed skill to an immutable version or content digest if the package manager supports it. - Use registry integrity metadata, signatures, or checksums to validate downloaded artifacts. - Maintain and review a lockfile for all transitive dependencies involved in installation. - Avoid suppressing installation confirmation unless the exact immutable artifact has already been verified. - Perform installation as an unprivileged account and grant only the filesystem and network access required by the skill. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: README.md:129
• Finding: SSH Password Exposed in Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `README.md:129-132` **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: High ### Vulnerable Code ```bash # Test SSH manually first sshpass -p 'YOUR_PASSWORD' ssh ubuntu@YOUR_SERVER_IP -p 22 ``` ### Technical Analysis The documented troubleshooting command passes the SSH password directly through the `-p` command-line option. Depending on the operating system and process-monitoring configuration, command-line arguments may be visible through process inspection interfaces, audit logs, monitoring agents, terminal recording, or diagnostic tools. The command may also be retained in shell history after execution. Quoting the password prevents ordinary shell expansion but does not prevent the complete command from being recorded or inspected. Any local user or service with sufficient process-observation or history-file access could recover the reusable SSH credential. ### Attack Path 1. A user replaces `YOUR_PASSWORD` with a real VPS password and executes the documented command. 2. The complete command is stored in shell history or exposed to process inspection, auditing, terminal capture, or monitoring software. 3. A local attacker, administrator, compromised monitoring agent, or later process with access to the history file retrieves the password. 4. The attacker authenticates to the overseas VPS using the exposed username, host, port, and password. 5. The attacker obtains the privileges associated with that SSH account and may use the VPS for further network access or attacks. ### Impact Assessment The attacker can obtain the permissions of the affected remote SSH account. If that account has passwordless `sudo`, administrative privileges, or access to sensitive applications, the impact may extend to full compromise of the tunnel VPS. The credential may also be reusable on other systems, increasing the scope of compromise. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace password authentication with an SSH key protected by a passphrase. - Remove examples that place secrets directly in command-line arguments. - If password authentication is unavoidable, use a protected interactive prompt or secure file descriptor rather than a command argument. - Ensure password values are never written to shell history, logs, status output, or error messages. - Restrict access to history files and monitoring systems, but do not treat those controls as a substitute for removing secrets from arguments. - Rotate any credential that has already been used through this command. - Configure the remote SSH account with least privilege and disable direct root login. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:51
• Finding: Plaintext SSH Password Supplied Through Environment Variables<![CDATA[ ## Vulnerability Details **File Location**: `README.md:51-59` **Vulnerability Type**: Plaintext sensitive-data handling **Risk Level**: Medium ### Vulnerable Code ```bash ## Environment Variables (for automation/CI) ```bash export TUNNEL_HOST=YOUR_SERVER_IP export TUNNEL_USER=ubuntu export TUNNEL_PASS=your_password export TUNNEL_PORT=22 connect.sh connect # no interaction needed ``` ``` Related documentation also instructs users to submit the password through Feishu command text in `SKILL.md:100-106` and states that credentials are stored locally in `~/.wcs_tunnel.conf` in `SKILL.md:253-257`. ### Technical Analysis The workflow places a reusable SSH password in the `TUNNEL_PASS` environment variable. Environment variables are plaintext process state and can leak through CI configuration, inherited child processes, debugging output, crash reports, process inspection, or accidental environment dumps. The broader documented workflow also introduces additional plaintext copies through chat history and a local configuration file. File mode `0600`, as documented for the configuration file, limits access to the owning account but does not encrypt the credential or protect it after that account is compromised. The submitted artifact does not include the documented `connect.sh`, so the exact downstream processing and cleanup of `TUNNEL_PASS` cannot be verified. ### Attack Path 1. A user or CI system exports a real SSH password as `TUNNEL_PASS`. 2. The variable is inherited by the tunnel script and potentially by child processes. 3. A diagnostic command, CI log, crash report, process inspector, or compromised process captures the environment. 4. The attacker recovers the VPS host, username, port, and password from configuration or related logs. 5. The attacker authenticates to the remote VPS and operates with the privileges of the compromised SSH account. For the chat-based setup path, a password entered in a Feishu command may similarly remain in ...[truncated 547 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Use SSH public-key authentication instead of reusable passwords. - Store private keys or unavoidable secrets in a dedicated secret manager and inject them only for the duration of the connection. - Do not request passwords through chat commands or retain them in message history. - Prevent CI systems from printing environments and configure mandatory secret masking. - Minimize environment inheritance and explicitly remove sensitive variables immediately after use. - Avoid plaintext credential files. If persistent storage is unavoidable, use an operating-system credential store or encrypted secret storage with strict access controls. - Redact passwords from status output, errors, debug logs, and subprocess output. - Rotate credentials that were previously submitted through chat, exported into CI environments, or saved in plaintext. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill description is incomplete relative to its actual operational model: it solicits credentials via chat commands, persists them locally, and exposes a command interface for tunnel orchestration. This mismatch can mislead users about the real trust boundary and data-handling behavior, increasing the chance they disclose secrets without informed consent.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

/万重山-隧道-关闭

# Remove skill files
rm -rf ~/.openclaw/workspace/skills/wcs-helper-network-skill
rm -f ~/.wcs_tunnel.conf
```

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

/万重山-隧道-关闭

# Remove skill files
rm -rf ~/.openclaw/workspace/skills/wcs-helper-network-skill
rm -f ~/.wcs_tunnel.conf
```

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Remove skill files
rm -rf ~/.openclaw/workspace/skills/wcs-helper-network-skill
rm -f ~/.wcs_tunnel.conf
```

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

return re.sub(r'\x1b\[[0-9;]*m', '', text)

def run(cmd, timeout=30):
    r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
    return r.returncode, r.stdout, r.stderr

def is_running():

• Confidence: 90% confidence
• Finding: This skill exposes chat-triggered operational commands that eventually execute shell commands to start and stop a network tunnel. Although user text is constrained to a small command set in this file, the tool controls privileged network behavior and uses shell execution underneath, so abuse of the tool path, environment, or called script can result in unauthorized command execution or unauthorized proxy/tunnel activation on the host.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The README instructs users to run `npx -y clawhub` without pinning a specific package version, which means future installs may fetch whatever version is current at execution time. That creates a supply-chain risk: a compromised upstream package, malicious update, or typosquat could execute arbitrary code during installation.

External Transmission

Medium

• Category: Data Exfiltration

Content

sg-git.sh push

# Route curl through tunnel
sg-curl.sh https://api.github.com/

# Route any command through tunnel
sg-bash.sh "pip install torch"

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

sg-git.sh push

# Route curl through tunnel
sg-curl.sh https://api.github.com/

# Route any command through tunnel
sg-bash.sh "pip install torch"

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The README tells users to export `TUNNEL_PASS` as a plaintext environment variable for automation without warning about exposure through shell history, process environments, logs, CI output, or inherited child processes. Because these credentials grant SSH access to the overseas server, leakage could directly enable unauthorized access and tunnel abuse.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README promotes installing a persistent auto-reconnect systemd service for network tunneling without warning that it creates ongoing background traffic redirection and host persistence. On shared or sensitive systems, that can lead to unnoticed proxying, policy violations, and a longer-lived foothold if the configuration or remote endpoint is later abused.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill advertises operational shell-backed behavior such as installing packages, launching SSH/autossh, and removing files, but it declares no explicit tool scope or permissions. In a skill system, missing scope declarations weakens least-privilege controls and makes it harder for users or the platform to understand what command execution capability the skill requires.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: The skill description requires use of Chinese slash commands such as '/万重山-隧道-开启' and repeats this pattern throughout the file, but does not offer alternate language triggers or explain that the skill is intentionally limited to a Chinese-language environment. This can violate language/locale policy when users are forced into one language without opt-in.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence
• Finding: Using `npx -y clawhub` without a pinned version causes execution of whatever package version is current at install time, creating a supply-chain risk. If the upstream package is compromised or changed incompatibly, users may run unreviewed code during installation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill tells users to send `IP`, `port`, `username`, and especially `password` through a chat command, but provides no warning about secret exposure, retention, logging, or safer alternatives. Chat systems and agent platforms often log messages, making this a direct credential leakage risk.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- The tunnel only handles outbound connections from your China server
- Your VPS provider can see the traffic (GitHub, ClawHub, etc.) but NOT your China server's other traffic
- No data is stored on the VPS — only encrypted transit
- Tunnel credentials are stored locally in `~/.wcs_tunnel.conf` (chmod 600)

---

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return re.sub(r'\x1b\[[0-9;]*m', '', text)

def run(cmd, timeout=30):
    r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
    return r.returncode, r.stdout, r.stderr

def is_running():

• Confidence: 89% confidence
• Finding: The helper wraps subprocess.run with shell=True, which makes every command string execute through a shell. In this file the current call sites use mostly fixed strings, but the abstraction invites future unsafe reuse and amplifies risk if CONNECT or any interpolated value becomes attacker-controlled, leading to command injection or execution of unintended shell metacharacters.

Static analysis

No suspicious patterns detected.