T06 · System Persistence
Error
- Location
references/examples.md:92- Finding
Persistent HLE Tunnel Through a System-Level Service
- Content
View full analysis
- Remediation
View remediation
Security audit
HLE Tunnel
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent and not malicious, but it needs Review because it can publish sensitive local agent/admin services to the internet and includes persistent tunnel examples without enough guardrails.
Install only if you intentionally want HLE to make selected local services reachable from the internet. Avoid exposing agent control panels, Jupyter, Portainer, Pi-hole, or other admin tools unless they also have strong native authentication. Prefer SSO allow lists, avoid auth-none for sensitive services, protect the API key, review active tunnels regularly, and do not run persistent background/systemd tunnels unless you also know how to stop and remove them.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:184- Finding
Unpinned Executable Packages and Mutable Container Images
- Content
View full analysis
- Remediation
View remediation
`. 3. Remove the mutable `latest` tag from security-sensitive examples. 4. Publish expected checksums and signature-verification instructions for release artifacts. 5. Use signed releases and verify package or container provenance through an established mechanism such as Sigstore. 6. Document an explicit update procedure so version changes receive security review before deployment. 7. Run the dependency with least privilege and restrict container networking, filesystem mounts, Linux capabilities, and environment access. 8. Prefer narrowly scoped, short-lived API credentials so compromise of a dependency has limited impact. 9. Enable registry and dependency monitoring to detect tag movement, ownership changes, compromised releases, and known vulnerabilities. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill enables exposing localhost-bound services, including the agent control UI and tools like Jupyter or Grafana, to the public internet, yet the introductory usage guidance does not prominently warn users about that trust boundary change. In this context, understated warnings are more dangerous because the skill is explicitly designed to publish sensitive local services remotely and share access with third parties, increasing the chance of accidental overexposure or misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The examples encourage exposing sensitive local services such as agent control UIs, admin dashboards, Jupyter, Pi-hole, and Portainer to the internet, but do not prominently warn about the security and privacy consequences. Even with SSO or allow-lists, these services may have their own weaknesses, weak auth assumptions, or sensitive data exposure, so normalizing remote publication of localhost admin interfaces materially increases attack surface.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The background tunnel examples show nohup and systemd usage to keep remote exposure persistent, but omit a warning that this creates continuous internet-reachable access to a local service. Persistent tunnels are more dangerous than temporary sharing because they can be forgotten, survive reboots, and increase the window for compromise or unauthorized access.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Background tunnel with process manager
bash # Using nohup nohup hle expose --service http://localhost:18789 --label my-agent > /dev/null 2>&1 & # Using systemd (create a service file)
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Background tunnel with process manager
bash # Using nohup nohup hle expose --service http://localhost:18789 --label my-agent > /dev/null 2>&1 & # Using systemd (create a service file)
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md # Using nohup nohup hle expose --service http://localhost:18789 --label my-agent > /dev/null 2>&1 & # Using systemd (create a service file) # /etc/systemd/system/hle-tunnel.service # [Unit] # Description=HLE Tunnel
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md # Using nohup nohup hle expose --service http://localhost:18789 --label my-agent > /dev/null 2>&1 & # Using systemd (create a service file) # /etc/systemd/system/hle-tunnel.service # [Unit] # Description=HLE Tunnel
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The documentation references use of
HLE_API_KEYas an environment variable and shows container examples with inline secret assignment, but it does not include clear handling guidance for that credential. In practice, environment-provided secrets can be exposed through shell history, process listings, shared compose files, screenshots, or accidental commits, so users should be warned to store and inject the API key carefully.- Content
Static analysis
No suspicious patterns detected.