Security audit

Stealth Proxy

Security checks for vulnerabilities and agentic risk

Overview

The VPN skill is mostly transparent about its network-routing purpose, but its install instructions run mutable latest packages and broadly update all skills.

Review before installing. The runtime VPN behavior is disclosed and includes consent gates, but avoid running the documented npx @latest and update --all commands unless you accept that they may execute newer unreviewed code and update unrelated skills. Prefer pinned, reviewed versions and update only the named dependencies you intend to use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:43
Finding: Unpinned Dependency Execution and Unnecessarily Broad Skill Updates
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The skill instructs users to execute npx -y clawhub@latest ..., which fetches and runs whatever package version is current at execution time rather than a reviewed, immutable release. This creates a supply-chain risk: if the package is compromised, typosquatted, or updated with malicious code, the user may execute attacker-controlled code locally.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: This command uses npx -y clawhub@latest, causing dynamic execution of the newest published package rather than a fixed artifact. In a security-sensitive networking skill, that means an attacker controlling the package or publication path could gain code execution on the operator's machine during installation/update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Referencing clawhub@latest delegates trust to the package registry at runtime and removes reproducibility. Because this skill orchestrates shell, VPN, DNS, and HTTP tooling, a compromised package could alter network settings, exfiltrate environment data, or install persistence.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Using an unpinned npx package in install instructions is a real supply-chain weakness, not just documentation noise, because users are encouraged to run it directly. The risk is amplified by the skill's purpose of changing routing and invoking privileged networking tools, which increases the damage a malicious package could do.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: This line again relies on clawhub@latest, allowing the executed code to change after the skill was reviewed. That undermines auditability and exposes users to registry compromise or malicious package updates with immediate local execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The instruction fetches the latest package at runtime, which is incompatible with secure, reproducible deployment practices. Since the skill deals with diagnostics and geo-switching, compromise here could misreport network state, manipulate DNS checks, or run arbitrary shell commands.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: An unpinned npx dependency lets future package changes silently alter the behavior of this skill's setup path. In context, this is particularly dangerous because the workflow touches external endpoints, credentials, and local network configuration, broadening the blast radius of any supply-chain compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: npx -y clawhub@latest update --all is especially risky because it both executes an unpinned package and instructs broad updating behavior. If the package or one of the updated components is malicious or compromised, the user could mass-install or update attacker-controlled code in one step.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Even the verification step uses npx -y clawhub@latest list, which still requires fetching and executing the latest package from the registry. Although read-only in intent, it still grants code execution opportunity to an untrusted future package version.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.