FreeGuard VPN Setup Guide

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:53 AM UTC
• Version: 0.8.9

Overview

This instruction-only VPN setup skill is mostly coherent, but it needs Review because it shows secret-bearing login commands and depends on an unpinned vendor CLI install.

Install this only if you trust the FreeGuard CLI source. Prefer the CLI's interactive or browser-based login, do not paste tokens or verification codes into chat, and avoid putting real secrets directly in shell commands. Verify the Homebrew formula or release checksum before installation, and expect the CLI to store local login state and possibly request administrator approval only if you choose system-wide protection.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47

Finding

Installation of an Unreviewed Vendor-Controlled CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:43-48
Vulnerability Type: Third-party supply-chain dependency
Risk Level: Medium

Code Snippet:

bash

brew install planetlinkinc/tap/freeguardvpn

Technical Analysis

The skill instructs users to install the freeguard executable from the vendor-controlled Homebrew tap planetlinkinc/tap. The audited package contains only documentation and does not include the Homebrew formula, CLI source code, executable artifact, or reproducible-build evidence. Consequently, the behavior and integrity of the installed executable cannot be established from this project.

Although using a named vendor tap is consistent with the skill's stated VPN setup purpose and is not evidence that the dependency is currently malicious, it creates a supply-chain trust boundary. Compromise of the tap repository, formula, release account, artifact hosting, or build pipeline could cause users to install modified code after the skill itself has been reviewed.

Attack Path

1. An attacker compromises the vendor's Homebrew tap, release account, artifact storage, or build pipeline.
2. The attacker modifies the formula or replaces the referenced CLI artifact with a malicious version.
3. A user follows the skill's installation instruction.
4. Homebrew retrieves and installs the altered dependency.
5. The malicious executable runs when the skill or user invokes freeguard, with the privileges of the current user and any additional permissions subsequently granted to the CLI.

Impact Assessment

A compromised dependency could execute arbitrary code with the installing user's privileges, access files and credentials available to that user, make network requests, or alter user-level configuration. If the user later approves an operating-system permission prompt for system-wide VPN functionality, the compromised executable could potentially operate with broader network or administrat ...[truncated 92 chars]

Remediation

View remediation

Remediation Suggestions

• Pin installation guidance to a reviewed CLI version instead of implicitly installing the latest available release.
• Publish and verify an immutable SHA-256 digest for the exact Homebrew artifact.
• Document how users can inspect the resolved formula and artifact URL before installation.
• Provide signed release artifacts and explain how to verify the signature against a separately distributed, trusted public key.
• Publish auditable CLI source code and reproducible-build provenance where possible.
• Retain the existing checksum requirement for manual downloads, but identify the exact release and checksum file rather than directing users to an unspecified latest asset.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:84

Finding

Authentication Secrets Passed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Locations: SKILL.md:84, SKILL.md:90, SKILL.md:106, and SKILL.md:144
Vulnerability Type: Sensitive information exposure through process arguments and shell history
Risk Level: Medium

Code Snippets:

bash

freeguard login --token <token> --json

bash

freeguard login --url <subscription_url> --json

bash

freeguard login --email <email> --code <code> --json

bash

freeguard subscribe portal --email <email> --code <code>

Technical Analysis

The documented non-interactive commands place access tokens, subscription URLs, and verification codes directly in process arguments. After users replace the placeholders with real values, those values may be recorded in interactive shell history. Depending on the operating system and process-isolation configuration, arguments may also be temporarily visible through process-listing or process-inspection interfaces.

Access tokens and subscription URLs may be long-lived bearer credentials. Verification codes are generally shorter-lived, but exposure during their validity period may still enable unauthorized authentication. The skill's prose advises users to enter codes directly into the CLI when possible, but the documented fallback still establishes an unsafe secret-handling pattern.

Attack Path

1. A user replaces a documented placeholder with a real token, subscription URL, or verification code.
2. The user executes the resulting command in an interactive shell.
3. The shell records the command in history, or the operating system exposes the active process arguments to another authorized local process or user.
4. A local attacker, malicious process, terminal logger, support bundle, or later history reader obtains the secret.
5. The attacker reuses the secret before expiration or revocation to authenticate to the account or access subscription-management f ...[truncated 549 chars]

Remediation

View remediation

Remediation Suggestions

• Remove examples that place tokens, subscription URLs, or verification codes directly in command-line arguments.
• Make interactive, non-echoing input the default and documented secret-entry mechanism.
• Add CLI support for reading secrets from standard input or a dedicated file descriptor if non-interactive operation is required.
• If file-based input is unavoidable, require a temporary file with owner-only permissions, delete it immediately after use, and ensure the CLI never logs its contents.
• Avoid environment variables for long-lived secrets where local process environments may be inspectable.
• Ensure JSON output, diagnostics, error messages, telemetry, and support bundles redact tokens, URLs, and verification codes.
• Recommend revoking exposed access tokens and clearing affected shell-history entries when users have already executed these commands with real credentials.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The skill explicitly supports token-based login via a command template containing --token <token>. Even though it says the CLI should handle it, this workflow may prompt users to paste sensitive access tokens into chat or expose them in shell history, terminal logs, process listings, or agent telemetry if mishandled. In the context of a VPN/account-management skill, credential material is especially sensitive because token compromise could enable account takeover or unauthorized subscription use.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

Sign In

If the user already has an access token or subscription URL, let the CLI handle it:

bash

freeguard login --token <token> --json

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/provenance.md (reported line 23)May include surrounding context.

md

The skill itself does not collect, store, upload, or transmit credentials. Login, subscription, connection, and local storage behavior are handled by the `freeguard` CLI and FreeGuard service endpoints over HTTPS.

Users should enter email verification codes, subscription URLs, and access tokens directly into the CLI or official browser flow whenever possible.

## Review Notes

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

Respect these boundaries:

- Do not ask the user to paste long-lived credentials or subscription tokens into chat.
- Do not handle passwords, payment card details, or verification codes outside the CLI or browser flow.
- Do not run account, billing, or connection-changing commands without telling the user what will happen.
- Prefer the standard non-elevated connection flow. Only discuss system-wide protection when the user explicitly asks for it.

Static analysis

No suspicious patterns detected.