Deploy Xray VLESS using 3X UI on your VPS

• Analyzed: Mar 25, 2026, 11:17 AM
• Findings: 1
• Version: 1.1.0
• Hash: 0474013eb6f020072bb714ab0a283de4ac9876b1e55a0af33d0a5537932881fb
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a comprehensive and security-conscious toolkit for deploying and managing a 3X-UI VPN server on a VPS. It implements several hardening measures, such as binding the management panel and subscription services to loopback (127.0.0.1), enforcing UFW firewall rules (allowing only SSH, HTTP, and HTTPS), and using Nginx as a reverse proxy with TLS termination. The scripts (e.g., bootstrap-host.sh, update-stack.sh) use proper shell escaping (printf %q) when passing variables to remote hosts to prevent injection. While it uses standard but inherently risky patterns like 'curl | bash' for Docker/ACME installation and handles SSH passwords via SSH_ASKPASS, these are aligned with the stated purpose of VPS automation and show no evidence of malicious intent or data exfiltration.