T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:248
- Finding
- Public TCP Tunneling of Sensitive Database Services Without Mandatory Safeguards## Vulnerability Details **File Location**: `SKILL.md`, lines 248–253 **Vulnerability Type**: Public exposure of sensitive local services **Risk Level**: High ### Vulnerable Code Snippet ```text ### 3. TCP Tunnel (Database) ``` 1. Read auth_token from config 2. create_tunnel(token, local_port=5432, protocol="tcp") 3. Return tcp://host:port for connection 4. close_tunnel(token, tunnel_id) when done ``` ``` ### Technical Analysis The documented workflow instructs the agent to expose a local PostgreSQL port through a publicly reachable TCP tunnel. The Skill also explicitly identifies PostgreSQL and Redis as intended tunneling targets. However, it does not require the agent to verify that the target service uses strong authentication, encrypted transport, source-address restrictions, or a least-privilege database account. The workflow does not require explicit user confirmation immediately before exposing a sensitive TCP service. It also lacks a mandatory expiration time or a guaranteed cleanup mechanism if the normal `close_tunnel` step is interrupted. Possession or discovery of the resulting public endpoint may therefore give remote parties direct network access to the local service. The tunnel does not inherently create a database vulnerability, but it can remove the network isolation on which a local database configuration may depend. Local services are frequently configured with weaker controls because they are expected to be reachable only from localhost. ### Attack Path 1. A user or agent follows the documented TCP database workflow. 2. The agent invokes `create_tunnel` for local port `5432` or another sensitive service port. 3. Rustunnel creates a publicly reachable TCP endpoint connected to the local database. 4. The endpoint is disclosed, leaked through logs or conversation history, or otherwise discovered by an attacker. 5. The attacker connects to the database through the tunnel. 6. If the database ...[truncated 1111 chars]
- Remediation
- ## Remediation Suggestions 1. Deny tunneling of sensitive ports such as PostgreSQL `5432`, Redis `6379`, MySQL `3306`, SSH `22`, and administrative interfaces by default. 2. Require explicit, informed user confirmation immediately before creating any TCP tunnel to a sensitive service. 3. Before exposure, verify that the service enforces strong authentication and does not use default, blank, or trust-based credentials. 4. Require transport encryption at the application layer where supported, especially for databases. 5. Use a dedicated least-privilege service account with narrowly scoped permissions. 6. Prefer tunnels that support source-IP allowlisting or an authenticated access gateway rather than unrestricted public TCP endpoints. 7. Assign a short automatic expiration time and guarantee cleanup through a `finally`-style lifecycle mechanism. 8. Avoid printing full sensitive endpoints into persistent logs or broadly visible conversation history. 9. Display a clear warning describing the public exposure scope before returning the endpoint. 10. Prefer private networking, VPN access, or SSH forwarding for database administration.