ClawHub
Back to skill

Security audit

Wcs Helper Network Skill

Security checks for vulnerabilities and agentic risk

Overview

This SSH tunnel skill has a clear purpose, but it handles SSH passwords and persistent network tunneling in ways users should review carefully before installing.

Install only on a machine you control and only if you are comfortable routing selected traffic through your own VPS. Prefer SSH keys or a secret manager over passwords, avoid pasting real passwords into chat or shell history, pin and review installer versions, and check for any systemd service or stored `~/.wcs_tunnel.conf` credential after use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
README.md:18
Finding

Unpinned Third-Party Package Execution Through npx

Content
View full analysis
Remediation
View remediation
`. - Pin the installed skill to an immutable version or content digest if the package manager supports it. - Use registry integrity metadata, signatures, or checksums to validate downloaded artifacts. - Maintain and review a lockfile for all transitive dependencies involved in installation. - Avoid suppressing installation confirmation unless the exact immutable artifact has already been verified. - Perform installation as an unprivileged account and grant only the filesystem and network access required by the skill. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
README.md:129
Finding

SSH Password Exposed in Command-Line Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
README.md:51
Finding

Plaintext SSH Password Supplied Through Environment Variables

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill description is incomplete relative to its actual operational model: it solicits credentials via chat commands, persists them locally, and exposes a command interface for tunnel orchestration. This mismatch can mislead users about the real trust boundary and data-handling behavior, increasing the chance they disclose secrets without informed consent.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.

/万重山-隧道-关闭

Remove skill files

rm -rf ~/.openclaw/workspace/skills/wcs-helper-network-skill rm -f ~/.wcs_tunnel.conf

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.

/万重山-隧道-关闭

Remove skill files

rm -rf ~/.openclaw/workspace/skills/wcs-helper-network-skill rm -f ~/.wcs_tunnel.conf

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

Remove skill files

rm -rf ~/.openclaw/workspace/skills/wcs-helper-network-skill rm -f ~/.wcs_tunnel.conf

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

This skill exposes chat-triggered operational commands that eventually execute shell commands to start and stop a network tunnel. Although user text is constrained to a small command set in this file, the tool controls privileged network behavior and uses shell execution underneath, so abuse of the tool path, environment, or called script can result in unauthorized command execution or unauthorized proxy/tunnel activation on the host.

Content

Scanner excerpt · scripts/tunnel_handler.py (reported line 18)May include surrounding context.

python
return re.sub(r'\x1b\[[0-9;]*m', '', text)

def run(cmd, timeout=30):
    r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
    return r.returncode, r.stdout, r.stderr

def is_running():

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The README instructs users to run npx -y clawhub without pinning a specific package version, which means future installs may fetch whatever version is current at execution time. That creates a supply-chain risk: a compromised upstream package, malicious update, or typosquat could execute arbitrary code during installation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 46)May include surrounding context.

md
sg-git.sh push

# Route curl through tunnel
sg-curl.sh https://api.github.com/

# Route any command through tunnel
sg-bash.sh "pip install torch"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 145)May include surrounding context.

md
sg-git.sh push

# Route curl through tunnel
sg-curl.sh https://api.github.com/

# Route any command through tunnel
sg-bash.sh "pip install torch"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README tells users to export TUNNEL_PASS as a plaintext environment variable for automation without warning about exposure through shell history, process environments, logs, CI output, or inherited child processes. Because these credentials grant SSH access to the overseas server, leakage could directly enable unauthorized access and tunnel abuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README promotes installing a persistent auto-reconnect systemd service for network tunneling without warning that it creates ongoing background traffic redirection and host persistence. On shared or sensitive systems, that can lead to unnoticed proxying, policy violations, and a longer-lived foothold if the configuration or remote endpoint is later abused.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill advertises operational shell-backed behavior such as installing packages, launching SSH/autossh, and removing files, but it declares no explicit tool scope or permissions. In a skill system, missing scope declarations weakens least-privilege controls and makes it harder for users or the platform to understand what command execution capability the skill requires.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The skill description requires use of Chinese slash commands such as '/万重山-隧道-开启' and repeats this pattern throughout the file, but does not offer alternate language triggers or explain that the skill is intentionally limited to a Chinese-language environment. This can violate language/locale policy when users are forced into one language without opt-in.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

Using npx -y clawhub without a pinned version causes execution of whatever package version is current at install time, creating a supply-chain risk. If the upstream package is compromised or changed incompatibly, users may run unreviewed code during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill tells users to send IP, port, username, and especially password through a chat command, but provides no warning about secret exposure, retention, logging, or safer alternatives. Chat systems and agent platforms often log messages, making this a direct credential leakage risk.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 249)May include surrounding context.

md
- The tunnel only handles outbound connections from your China server
- Your VPS provider can see the traffic (GitHub, ClawHub, etc.) but NOT your China server's other traffic
- No data is stored on the VPS — only encrypted transit
- Tunnel credentials are stored locally in `~/.wcs_tunnel.conf` (chmod 600)

---

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
89% confidence
Finding

The helper wraps subprocess.run with shell=True, which makes every command string execute through a shell. In this file the current call sites use mostly fixed strings, but the abstraction invites future unsafe reuse and amplifies risk if CONNECT or any interpolated value becomes attacker-controlled, leading to command injection or execution of unintended shell metacharacters.

Content

Scanner excerpt · scripts/tunnel_handler.py (reported line 18)May include surrounding context.

python
return re.sub(r'\x1b\[[0-9;]*m', '', text)

def run(cmd, timeout=30):
    r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
    return r.returncode, r.stdout, r.stderr

def is_running():