Anyone Procotol Proxy

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:40 AM UTC
• Version: 0.1.0

Overview

The skill is coherent for running an Anyone Network SOCKS proxy, but it asks users to install and run a mutable third-party npm package with network-traffic authority and limited risk guidance.

Review this before installing. Use a pinned, reviewed package version where possible, avoid global installation, run the proxy with least privilege, and do not route secrets or regulated data through it unless you have approved the provider, environment, and compliance posture.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Third-Party Package Is Installed and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–30
Vulnerability Type: Unpinned and mutable npm dependency execution
Risk Level: Medium

Vulnerable Code

yaml

metadata:
  clawdbot:
    requires:
      packages:
        - "@anyone-protocol/anyone-client"

bash

npm install -g @anyone-protocol/anyone-client

bash

npx @anyone-protocol/anyone-client -s 9050

Technical Analysis

The skill directs users to install and execute @anyone-protocol/anyone-client without specifying an exact reviewed version or an integrity hash. Both the global installation command and the npx invocation rely on mutable package-registry state. Consequently, the code executed when the instructions are followed may differ from the code available when the skill was audited.

Installing the package globally increases its local reach and may execute npm lifecycle scripts. The subsequent npx command executes the package CLI, potentially downloading it from the configured npm registry if it is not already available locally. This creates a supply-chain trust boundary that is not protected by version pinning, lockfile verification, artifact integrity validation, or source verification.

There is no evidence in the reviewed file that the named dependency is currently malicious. The vulnerability is the unsafe installation and execution pattern, which exposes users to future package, maintainer-account, registry, or publication-channel compromise.

Attack Path

1. An attacker compromises the package maintainer account, package publication process, configured npm registry, or another relevant supply-chain component.
2. The attacker publishes a malicious version of @anyone-protocol/anyone-client.
3. A user follows the skill instructions and runs the unpinned global installation or npx command.
4. npm resolves and downloads the attacker-controlled package version.
5. Malicious lifecycle ...[truncated 999 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact version that has undergone security review, rather than relying on the registry's current default version.
2. Install the dependency locally inside a dedicated project instead of globally, and execute only the locally installed binary.
3. Commit and enforce a lockfile with package integrity metadata. Use deterministic installation commands such as npm ci where applicable.
4. Verify the package source, publisher identity, provenance, signatures, and integrity before installation.
5. Avoid an unqualified npx invocation. If npx is required, specify the exact reviewed package version and configure it not to accept an unexpected remote replacement.
6. Disable npm lifecycle scripts during installation where compatible with the package, then explicitly run only reviewed setup operations.
7. Execute the proxy with least privilege in an isolated account, container, or sandbox with restricted filesystem, environment-variable, credential, and network access.
8. Bind the SOCKS proxy explicitly to the loopback interface and prevent access from untrusted local or remote users.
9. Document the trusted npm registry and implement dependency monitoring so newly disclosed package or transitive-dependency risks can be identified promptly.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill explicitly enables routing requests through an anonymity network and hidden-service access but does not warn about legal, policy, monitoring, logging, attribution, or sensitive-data risks. That omission can mislead users into overtrusting the privacy properties of the proxy, increasing the chance of unsafe or noncompliant use in monitored or regulated environments.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Using npx @anyone-protocol/anyone-client without a pinned version causes execution of whatever package version is current at runtime, which creates a supply-chain risk if the package is updated maliciously, compromised, or unexpectedly changed. In this skill, the command starts a local proxy process that can handle network traffic, so compromise could lead to traffic interception, arbitrary code execution in the user environment, or covert persistence.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.