WSL Proxy

AdvisoryAudited by Static analysis on May 4, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Running the setup command changes proxy-related environment variables in the current shell, which can affect later network requests from that shell.

Why it was flagged

The documented setup uses eval to execute shell commands emitted by the helper script in the user's current shell. The included script emits proxy-related export and echo commands, so this is purpose-aligned, but eval should be treated carefully.

Skill content
eval "$(bash skills/wsl-proxy/scripts/setup_proxy.sh)"
Recommendation

Before using eval, run `bash skills/wsl-proxy/scripts/setup_proxy.sh` once to inspect the output, and only run the skill from a trusted local copy.

What this means

The script may contact ports on the Windows host and can identify a reachable proxy service.

Why it was flagged

The detection script probes common proxy ports on the WSL gateway and validates HTTP proxy behavior. This is expected for automatic proxy discovery, but it is still local network probing.

Skill content
COMMON_PORTS=(7890 7897 1080 10808 10809 1081 8888 8080 9090 6152 7891)
Recommendation

Use it only when you intend to discover and use the Windows host proxy; review or edit the port list if your environment has special network constraints.

What this means

Running detection may make an outbound test request visible to the proxy provider and httpbin.org.

Why it was flagged

The proxy validation sends a test HTTP request to httpbin.org through the candidate proxy. This is consistent with checking whether a port behaves as an HTTP proxy, but it is an external network contact.

Skill content
GET http://httpbin.org/get HTTP/1.0
Recommendation

If external test requests are not acceptable, replace the test URL with an approved internal endpoint before running the script.

What this means

If you add the snippet to a shell startup file, future shells may continue routing HTTP and HTTPS traffic through the detected proxy until you remove it.

Why it was flagged

The documentation describes an optional way to make proxy environment variables permanent in shell startup files. This is disclosed and user-directed, not automatic persistence.

Skill content
追加到 `~/.bashrc` 或 `~/.zshrc`
Recommendation

Only add persistent proxy settings if you want that behavior across sessions, and keep a note of the lines to remove if you later want to disable it.