ClawHub
Back to skill

Security audit

Rustunnel

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but it can expose local services, including databases, to the public internet with too little per-use warning or control.

Install only if you are comfortable with an agent creating public tunnel endpoints from your machine. Avoid using it for databases or admin ports unless the service has strong authentication, least-privilege accounts, encryption, and you close the tunnel promptly. Prefer verified/pinned installation methods and avoid the unpinned sudo source-build path.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:248
Finding

Public TCP Tunneling of Sensitive Database Services Without Mandatory Safeguards

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 248–253
Vulnerability Type: Public exposure of sensitive local services
Risk Level: High

Vulnerable Code Snippet

text
### 3. TCP Tunnel (Database)
  1. Read auth_token from config
  2. create_tunnel(token, local_port=5432, protocol="tcp")
  3. Return tcp://host:port for connection
  4. close_tunnel(token, tunnel_id) when done
text

Technical Analysis

The documented workflow instructs the agent to expose a local PostgreSQL port through a publicly reachable TCP tunnel. The Skill also explicitly identifies PostgreSQL and Redis as intended tunneling targets. However, it does not require the agent to verify that the target service uses strong authentication, encrypted transport, source-address restrictions, or a least-privilege database account.

The workflow does not require explicit user confirmation immediately before exposing a sensitive TCP service. It also lacks a mandatory expiration time or a guaranteed cleanup mechanism if the normal close_tunnel step is interrupted. Possession or discovery of the resulting public endpoint may therefore give remote parties direct network access to the local service.

The tunnel does not inherently create a database vulnerability, but it can remove the network isolation on which a local database configuration may depend. Local services are frequently configured with weaker controls because they are expected to be reachable only from localhost.

Attack Path

  1. A user or agent follows the documented TCP database workflow.
  2. The agent invokes create_tunnel for local port 5432 or another sensitive service port.
  3. Rustunnel creates a publicly reachable TCP endpoint connected to the local database.
  4. The endpoint is disclosed, leaked through logs or conversation history, or otherwise discovered by an attacker.
  5. The attacker connects to the database through the tunnel.
  6. If the database ...[truncated 1111 chars]
Remediation
View remediation

Remediation Suggestions

  1. Deny tunneling of sensitive ports such as PostgreSQL 5432, Redis 6379, MySQL 3306, SSH 22, and administrative interfaces by default.
  2. Require explicit, informed user confirmation immediately before creating any TCP tunnel to a sensitive service.
  3. Before exposure, verify that the service enforces strong authentication and does not use default, blank, or trust-based credentials.
  4. Require transport encryption at the application layer where supported, especially for databases.
  5. Use a dedicated least-privilege service account with narrowly scoped permissions.
  6. Prefer tunnels that support source-IP allowlisting or an authenticated access gateway rather than unrestricted public TCP endpoints.
  7. Assign a short automatic expiration time and guarantee cleanup through a finally-style lifecycle mechanism.
  8. Avoid printing full sensitive endpoints into persistent logs or broadly visible conversation history.
  9. Display a clear warning describing the public exposure scope before returning the endpoint.
  10. Prefer private networking, VPN access, or SSH forwarding for database administration.

T08 · Insecure Dependencies

Error
Location
SKILL.md:277
Finding

Unpinned Remote Source Build Followed by Privileged System-Wide Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 277–281
Vulnerability Type: Unverified third-party dependency installation
Risk Level: High

Vulnerable Code Snippet

bash
# Or build from source
git clone https://github.com/joaoh82/rustunnel.git
cd rustunnel
make release-mcp
sudo install -m755 target/release/rustunnel-mcp /usr/local/bin/rustunnel-mcp

Technical Analysis

The installation procedure clones and builds the repository's mutable default branch. It does not pin a reviewed release tag or commit and does not verify a cryptographic checksum, signed release, source signature, or provenance attestation.

Consequently, the code executed by make release-mcp can change after the Skill has been audited. The procedure then uses sudo to install the resulting executable into /usr/local/bin, a system-wide executable location. This combines an unverified remote dependency with a privileged deployment step.

A compromised upstream repository, malicious maintainer update, compromised dependency, or manipulated build configuration could introduce attacker-controlled code. The installed binary would subsequently be invoked as the Rustunnel MCP server and would be positioned to receive authentication tokens and tunnel-management requests.

Attack Path

  1. The upstream repository, maintainer account, release process, dependency graph, or build configuration is compromised or maliciously modified.
  2. The user follows the Skill's installation instructions and clones the current default branch.
  3. make release-mcp builds the attacker-controlled source or executes malicious build-time logic under the user's account.
  4. The user runs sudo install, placing the unverified binary at /usr/local/bin/rustunnel-mcp.
  5. The MCP client later resolves and executes that system-wide binary as a trusted MCP server.
  6. The malicious process receives Rustunnel tokens and tool parameters, can falsi ...[truncated 1201 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin installation to a specific reviewed release tag and immutable commit hash.
  2. Download an official signed release artifact rather than building the mutable default branch.
  3. Verify a publisher-provided SHA-256 or stronger checksum over the downloaded artifact.
  4. Verify release signatures, commit signatures, and available provenance attestations against a trusted publisher identity.
  5. Record the expected version, commit, checksum, and verification commands directly in the Skill.
  6. Review and lock transitive dependencies using the ecosystem lockfile and perform builds with locked dependency resolution.
  7. Build in an isolated, unprivileged environment without access to user secrets.
  8. Avoid sudo and install into a user-owned directory where possible.
  9. If system-wide installation is necessary, separately verify the completed artifact before performing the narrow privileged copy operation.
  10. Prefer a trusted package manager formula that is version-pinned and checksum-verified.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly encourages exposing local HTTP and TCP services, including databases, to public URLs for testing and sharing. Even if intentional, this creates a real risk of accidental internet exposure of sensitive services without strong user-facing warnings about authentication, network access controls, or data leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill directs the agent to read and persist authentication tokens from ~/.rustunnel/config.yml and reuse them automatically. This is sensitive credential handling, and the lack of clear privacy boundaries or guidance against echoing/logging the token increases the chance of credential disclosure through agent output, logs, or misuse.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
92% confidence
Finding

The skill instructs the agent to persist the user's auth token in ~/.rustunnel/config.yml for future reuse. Long-lived credential storage creates ongoing exposure if the local account, filesystem, backups, or agent logs are later compromised, and the workflow does not emphasize token lifecycle or revocation.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

  1. Check if config file exists: ~/.rustunnel/config.yml
  2. If not, ask user: "What's your rustunnel auth token and server address?"
  3. Create config file directly:
    bash
    mkdir -p ~/.rustunnel
chmod 700 ~/.rustunnel

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

  1. Create config file directly:
    bash
    mkdir -p ~/.rustunnel
chmod 700 ~/.rustunnel
  2. Write config with user's token:
    yaml

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

  1. Create config file directly:
    bash
    mkdir -p ~/.rustunnel
chmod 700 ~/.rustunnel
  2. Write config with user's token:
    yaml

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

server: auth_token:

text
5. **Set permissions:** `chmod 600 ~/.rustunnel/config.yml`

---

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

server: auth_token:

text
5. **Set permissions:** `chmod 600 ~/.rustunnel/config.yml`

---

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
84% confidence
Finding

The instruction to use stored values and "don't ask the user every time" reduces user awareness and approval for repeated use of a credential and network-exposing action. In this context, automation can cause the agent to create public tunnels or reuse secrets without sufficiently informed consent for each risky operation.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

server: edge.rustunnel.com:4040

text

Use these values in tool calls - **don't ask the user every time.**

### Step 3: Use MCP Tools

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.

text
1. Read auth_token from ~/.rustunnel/config.yml
2. Create tunnel: create_tunnel(token, local_port=3000, protocol="http")
3. Store tunnel_id for later cleanup
4. Return public_url to user
5. When done: close_tunnel(token, tunnel_id)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
88% confidence
Finding

The documented installation path uses sudo install into /usr/local/bin, which introduces privileged execution into the workflow. If followed blindly, this increases the risk from compromised build artifacts, path hijacking, or unsafe source builds performed with elevated privileges.

Content

Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.

git clone https://github.com/joaoh82/rustunnel.git cd rustunnel make release-mcp sudo install -m755 target/release/rustunnel-mcp /usr/local/bin/rustunnel-mcp

text

2. **Config file:** `~/.rustunnel/config.yml` with `auth_token` set

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 321)May include surrounding context.

md
- Tokens are sent over HTTPS (use `--insecure` only in local dev)
- MCP tools handle process cleanup automatically
- Tunnels are closed when MCP server exits
- Config file should be protected: `chmod 600 ~/.rustunnel/config.yml`

---

Excessive Permissions

Low
Category
Privilege Escalation
Confidence
80% confidence
Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

server: auth_token:

text
5. **Set permissions:** `chmod 600 ~/.rustunnel/config.yml`

---

Static analysis

No suspicious patterns detected.