pr0xteus

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:55 AM UTC
• Version: 0.11.4

Overview

The skill is coherent for a self-hosted private proxy system, but its setup path asks users to run a mutable remote installer with optional root privileges.

Install only if you trust the publisher and are comfortable auditing or replacing the setup flow. Prefer downloading from an immutable release or commit, verify a checksum or signature, avoid the sudo installer path unless necessary, keep PR0XTEUS_API_TOKEN in a secret store, bind the controller only to loopback or a protected private network, and restrict agents from Docker socket access and broad cell deletion.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/setup.md:17

Finding

Mutable Remote Installer Downloaded and Executed with Optional Root Privileges

Content

View full analysis

Vulnerability Details

File Location: references/setup.md, lines 17–35
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash

**Download the installer and read it before running it — never pipe `curl`
straight into a shell.** Confirm it only fetches the pinned image, runs the
image's `config init`, and installs the `pr0xteus` command — then run it.

# 1. Download (do not pipe curl into a shell).
curl -fsSL https://raw.githubusercontent.com/psyb0t/pr0xteus/main/install.sh -o pr0xteus-install.sh

# 2. Inspect — read the whole thing.
less pr0xteus-install.sh

# 3a. Per-user install (no root): command -> ~/.local/bin, config ->
#     ~/.config/pr0xteus, just for the current user.
bash pr0xteus-install.sh

# 3b. Or system-wide: command -> /usr/local/bin, config -> /etc/pr0xteus
#     (root-owned, readable by the `docker` group so any docker-group operator
#     drives the one shared stack).
sudo bash pr0xteus-install.sh --system

Technical Analysis

The setup procedure retrieves a shell script from the upstream repository's mutable main branch and subsequently executes it. The URL is not pinned to an immutable commit, and the procedure does not require verification using a cryptographic signature or a trusted checksum.

Consequently, the effective executable payload can change after this Skill has been reviewed. The installer itself is not included in the audited artifact, so its behavior cannot be statically verified as part of this audit.

Advising the operator to inspect the file with less is a useful precaution but does not establish authenticity or integrity. Manual inspection is especially unreliable in automated Agent workflows and can miss subtle malicious changes. The optional sudo bash command amplifies the exposure by granting the unverified payload root privileges.

Attack Path

1. An attacker compromises the upstrea ...[truncated 1482 chars]

Remediation

View remediation

Remediation Suggestions

1. Vendor the installer inside the Skill artifact so that its exact contents are available for review.
2. If remote retrieval is necessary, use an immutable release artifact or a URL pinned to a specific commit rather than the main branch.
3. Publish a cryptographic checksum through a separately trusted release channel and require verification before execution.
4. Prefer signed release artifacts and verify the maintainer's signature against a documented trusted key.
5. Fail closed if checksum or signature verification fails; do not present verification as optional.
6. Remove the direct sudo bash workflow. Separate privileged installation actions into a minimal, auditable helper with narrowly scoped permissions.
7. Pin associated container images by immutable digest rather than only by version tags, and avoid security-sensitive :latest or rolling deployment paths.
8. Ensure setup instructions display and verify the resolved immutable version before any local execution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

permissions:
  network: "Runtime control-API calls go only to the user-configured PR0XTEUS_URL. Traffic sent through allocated SOCKS5 or HTTP URLs exits through operator-configured WireGuard infrastructure; use only trusted private control endpoints and operator-approved destination URLs. pkg/client's preflight check additionally makes direct, unproxied calls to api.ipify.org and ifconfig.me to confirm the exit IP actually changed. Setup time (references/setup.md) also reaches raw.githubusercontent.com for the installer and Docker Hub for the pinned image."
  shell: "bash, curl, jq, and explicit Docker commands from references/setup.md for user-requested setup or verification."
  filesystem: "Normal use reads PR0XTEUS_URL and PR0XTEUS_API_TOKEN from the environment. Operator setup writes only gitignored local WireGuard, pool, routing, token, and .env files."
---

# pr0xteus

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 50)May include surrounding context.

md

permissions:
  network: "Runtime control-API calls go only to the user-configured PR0XTEUS_URL. Traffic sent through allocated SOCKS5 or HTTP URLs exits through operator-configured WireGuard infrastructure; use only trusted private control endpoints and operator-approved destination URLs. pkg/client's preflight check additionally makes direct, unproxied calls to api.ipify.org and ifconfig.me to confirm the exit IP actually changed. Setup time (references/setup.md) also reaches raw.githubusercontent.com for the installer and Docker Hub for the pinned image."
  shell: "bash, curl, jq, and explicit Docker commands from references/setup.md for user-requested setup or verification."
  filesystem: "Normal use reads PR0XTEUS_URL and PR0XTEUS_API_TOKEN from the environment. Operator setup writes only gitignored local WireGuard, pool, routing, token, and .env files."
---

# pr0xteus

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 117)May include surrounding context.

md

permissions:
  network: "Runtime control-API calls go only to the user-configured PR0XTEUS_URL. Traffic sent through allocated SOCKS5 or HTTP URLs exits through operator-configured WireGuard infrastructure; use only trusted private control endpoints and operator-approved destination URLs. pkg/client's preflight check additionally makes direct, unproxied calls to api.ipify.org and ifconfig.me to confirm the exit IP actually changed. Setup time (references/setup.md) also reaches raw.githubusercontent.com for the installer and Docker Hub for the pinned image."
  shell: "bash, curl, jq, and explicit Docker commands from references/setup.md for user-requested setup or verification."
  filesystem: "Normal use reads PR0XTEUS_URL and PR0XTEUS_API_TOKEN from the environment. Operator setup writes only gitignored local WireGuard, pool, routing, token, and .env files."
---

# pr0xteus

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 126)May include surrounding context.

md

permissions:
  network: "Runtime control-API calls go only to the user-configured PR0XTEUS_URL. Traffic sent through allocated SOCKS5 or HTTP URLs exits through operator-configured WireGuard infrastructure; use only trusted private control endpoints and operator-approved destination URLs. pkg/client's preflight check additionally makes direct, unproxied calls to api.ipify.org and ifconfig.me to confirm the exit IP actually changed. Setup time (references/setup.md) also reaches raw.githubusercontent.com for the installer and Docker Hub for the pinned image."
  shell: "bash, curl, jq, and explicit Docker commands from references/setup.md for user-requested setup or verification."
  filesystem: "Normal use reads PR0XTEUS_URL and PR0XTEUS_API_TOKEN from the environment. Operator setup writes only gitignored local WireGuard, pool, routing, token, and .env files."
---

# pr0xteus

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 128)May include surrounding context.

Fill secrets/wireguard/*.conf, secrets/pools.yaml, config/egress-routing.yaml,

and PR0XTEUS_API_TOKEN in .env (see above), then bring the stack up:

docker compose --project-directory "$config_dir"
--env-file "$config_dir/.env"
-f "$config_dir/docker-compose.yml"
-f "$config_dir/docker-compose.host-ports.yml" up -d

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 86% confidence

Finding

The documented DELETE /v1/cells/{containerID} operation is a destructive action that stops containers, and the safety control is only advisory text ('Only destroy a cell your own task allocated'). If an agent is allowed to supply arbitrary containerID values or lacks server-side ownership validation, this can be abused to terminate other users' active cells and cause denial of service.

Content

Scanner excerpt · references/setup.md (reported line 204)May include surrounding context.

md

cell's control server. `GET /v1/cells/{containerID}` 404s when the ID isn't
tracked.

`DELETE /v1/cells/{containerID}` stops that cell's container and clears its
pool slot so the next request re-spawns; `204` on success, `404` when
untracked. Only destroy a cell your own task allocated, and only when the
user asked for it.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

Health lives on the separate metrics listener and deliberately has no token:

bash

curl --fail --silent http://127.0.0.1:9091/healthz

Ask for the configured US route:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

the old URL:

bash

curl --fail-with-body --request POST \
  "${auth_header[@]}" \
  --header 'Content-Type: application/json' \
  --data '{"country":"US","excludeProxy":"socks5://previous-lease-id:previous-secret@127.0.0.1:1080"}' \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/setup.md (reported line 22)May include surrounding context.

image's config init, and installs the pr0xteus command — then run it.

bash

# 1. Download (do not pipe curl into a shell).
curl -fsSL https://raw.githubusercontent.com/psyb0t/pr0xteus/main/install.sh -o pr0xteus-install.sh

# 2. Inspect — read the whole thing.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 35)May include surrounding context.

3b. Or system-wide: command -> /usr/local/bin, config -> /etc/pr0xteus

(root-owned, readable by the docker group so any docker-group operator

drives the one shared stack).

sudo bash pr0xteus-install.sh --system

text

The mode auto-detects from who runs it (root → system-wide, otherwise

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/setup.md (reported line 114)May include surrounding context.

bash

config_dir=~/.config/pr0xteus            # any directory you own
image=psyb0t/pr0xteus:vX.Y.Z             # pin a released tag
mkdir -p "$config_dir"
docker pull "$image"

# Scaffold compose + .env + config skeleton and refresh .env.example (.env stays untouched).

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/setup.md (reported line 226)May include surrounding context.

md

auth_header=(--header @<(printf 'Authorization: Bearer %s' "$PR0XTEUS_API_TOKEN"))

curl --fail-with-body "${auth_header[@]}" "$PR0XTEUS_URL/v1/pools" | jq .
curl --fail-with-body --request POST "${auth_header[@]}" \
  --header 'Content-Type: application/json' \
  --data '{"pool":"us"}' \
  "$PR0XTEUS_URL/v1/proxies"

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The file mixes two trust boundaries: operator-level instructions earlier show how to read the bearer token from the operator .env and manage Docker directly, while the later agent-use section says agents must not read operator secrets or the Docker socket. This inconsistency can cause an agent or integrator to apply privileged operator steps in an agent context, leading to secret exposure or unauthorized container control.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.