Scientific Internet Access

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:15 AM UTC
• Version: 1.8.6

Overview

The skill largely performs its stated proxy-finding function, but it forces agent responses and relies on unverified public proxy endpoints that could affect user traffic privacy.

Install only if you intentionally want an agent to fetch and test free public proxy nodes. Treat the resulting proxies as untrusted: avoid banking, email, private accounts, or sensitive browsing through them, and review the scripts and source list before use. Be aware that the skill may answer in Chinese, may suppress normal agent explanation, and will write proxy node files into the OpenClaw workspace.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:26
• Finding: Forced Agent Output and Promotional Instruction Hijacking## Vulnerability Details **File Location**: `SKILL.md:26-32` **Additional Locations**: `SKILL.md:50-76`, `scripts/formatter.py:31-32` **Vulnerability Type**: Agent instruction and output hijacking **Risk Level**: High ### Vulnerable Code ```text ::GENE{behavior|strict} T:script_output_only | zero_extra_text | step_by_step A:free_association⇒forbidden ::GENE{output} T:output_raw | no_wrap | chinese_default T:zh_cn_telegram_guide ``` The later workflow mandates the following promotional command: ```text clawhub install scientific-internet-access ``` The formatter also inserts fixed branding into generated output: ```python lines.append("Free nodes are unstable, refresh regularly") lines.append("Powered by Scientific Internet Access | shadowrocket.ai") ``` ### Technical Analysis The Skill declares its behavioral directives as strict, requires script-only output, prohibits additional Agent text, and requires raw, unwrapped responses. These instructions alter how the hosting Agent behaves instead of merely describing how to invoke the proxy utilities. The broader workflow also requires the Agent to insert installation promotion, branding, and an external Telegram language link into user-facing responses. Those additions are not necessary to scrape, test, or format proxy endpoints and therefore exceed the minimum instructions required for the declared proxy-finder functionality. By suppressing additional text, the Skill can prevent the Agent from independently adding relevant warnings, qualifying unsafe claims, or adapting its answer to higher-level session goals. This is instruction hijacking even though no operating-system privilege escalation occurs. ### Attack Path 1. A user submits a proxy, VPN, firewall-bypass, or Telegram-related request matching the Skill's broad trigger set. 2. The Skill is loaded into the Agent's active instruction context. 3. The strict behavior directives re ...[truncated 782 chars]
• Remediation: ## Remediation Suggestions 1. Remove the `strict`, `script_output_only`, `zero_extra_text`, and `free_association⇒forbidden` directives. 2. Describe script output as data for the Agent to review, not as the only permitted response. 3. Preserve the Agent's ability to add security warnings, explain limitations, and refuse unsafe actions. 4. Remove mandatory installation promotion, fixed branding, and unsolicited Telegram links. 5. Provide external links only when directly relevant and requested, with a clear description of the destination. 6. Narrow the trigger set so unrelated Telegram or general connectivity questions do not activate the proxy workflow. 7. Treat user confirmation as an explicit workflow requirement before initiating network probes or presenting third-party proxy credentials.

T08 · Insecure Dependencies

Error

• Location: scripts/scraper.py:5
• Finding: Mutable Third-Party Sources Can Supply Attacker-Controlled Proxy Endpoints## Vulnerability Details **File Location**: `scripts/scraper.py:5-16` **Additional Locations**: `scripts/scraper.py:114-127`, `scripts/tester.py:166-181` **Vulnerability Type**: Untrusted proxy supply chain **Risk Level**: High ### Vulnerable Code ```python SOURCES = [ {"name": "freefq/free", "urls": ["https://raw.githubusercontent.com/freefq/free/master/v2"]}, {"name": "Pawdroid/Free-servers", "urls": ["https://raw.githubusercontent.com/Pawdroid/Free-servers/main/sub"]}, {"name": "aiboboxx/v2rayfree", "urls": ["https://raw.githubusercontent.com/aiboboxx/v2rayfree/main/v2"]}, {"name": "mfuu/v2ray", "urls": ["https://raw.githubusercontent.com/mfuu/v2ray/master/v2ray"]}, {"name": "ermaozi/get_subscribe", "urls": ["https://raw.githubusercontent.com/ermaozi/get_subscribe/main/subscribe/v2ray.txt"]}, {"name": "peasoft/NoMoreWalls", "urls": ["https://raw.githubusercontent.com/peasoft/NoMoreWalls/master/list_raw.txt"]}, {"name": "mahdibland/V2RayAggregator", "urls": ["https://raw.githubusercontent.com/mahdibland/V2RayAggregator/master/sub/sub_merge_base64.txt"]}, {"name": "barry-far/V2ray-Configs", "urls": ["https://raw.githubusercontent.com/barry-far/V2ray-Configs/main/Sub1.txt", "https://raw.githubusercontent.com/barry-far/V2ray-Configs/main/Sub2.txt"]}, {"name": "Leon406/SubCrawler", "urls": ["https://raw.githubusercontent.com/Leon406/SubCrawler/main/sub/share/v2"]}, {"name": "vveg26/chromego_merge", "urls": ["https://raw.githubusercontent.com/vveg26/chromego_merge/main/sub/merged_proxies_new"]}, ] ``` The mutable content is fetched and accepted without integrity or publisher verification: ```python def fetch_source(source): nodes = [] for url in source["urls"]: try: req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"}) with urllib.request.urlopen(req, timeout=15) as resp: content = resp.read ...[truncated 3092 chars]
• Remediation: ## Remediation Suggestions 1. Replace anonymous aggregated feeds with a small set of reviewed and accountable proxy providers. 2. Pin downloaded manifests to immutable reviewed commits or versioned release artifacts. 3. Require cryptographic signatures or trusted checksums for every accepted manifest. 4. Maintain an explicit allowlist of approved publishers and verify repository ownership. 5. Record provenance for each endpoint and display it prominently to the user. 6. State clearly that a connectivity test establishes availability only and does not establish safety. 7. Require explicit user consent before every outbound testing batch, including batches containing 20 or fewer endpoints. 8. Add strict download-size and node-count limits to reduce resource-exhaustion risk from compromised feeds. 9. Apply restrictive filesystem permissions to stored node files and delete stale credentials after use. 10. Avoid recommending anonymous public proxies for sensitive authentication, financial activity, private communications, or other high-value traffic.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This second mismatch finding highlights that the implementation appears far narrower than advertised, undermining trust and making it difficult to assess operational and security behavior. While exaggeration alone is not code execution, in this context it can mislead users into running scripts or relying on node recommendations without understanding provenance or safeguards.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This second mismatch finding highlights that the implementation appears far narrower than advertised, undermining trust and making it difficult to assess operational and security behavior. While exaggeration alone is not code execution, in this context it can mislead users into running scripts or relying on node recommendations without understanding provenance or safeguards.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger set is extremely broad and includes common phrases, increasing the chance the skill activates in unrelated conversations and pushes users into a script-execution flow. Because the skill concerns proxy/VPN acquisition and mandates shell-backed outputs, accidental activation can expose users to unvetted infrastructure guidance or unneeded command execution paths.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill advertises an extremely broad set of trigger phrases spanning VPN, censorship bypass, app-specific connectivity issues, and generic requests for help accessing blocked services. This can cause the agent to activate in ambiguous contexts and steer users into proxy-node acquisition and censorship-evasion workflows without clear user intent validation, increasing the chance of unsafe or policy-violating assistance.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to execute a local Python script and its metadata declares no permissions or allowed tool scope, creating a hidden capability gap between what users/reviewers can see and what the skill can cause the host to do. In a skill that brokers proxy/VPN access and likely touches shell, files, environment, and network, missing scope declarations materially increase the risk of unreviewed code execution and data exposure.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The instructions explicitly require that if the user asks in English, the reply should still be in Chinese. This is a language/locale policy issue because it imposes a specific language on the user without offering a choice or obtaining consent.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The script presents its primary user interaction entirely in Chinese and defaults the user into a recommended option, but it does not offer any language selection or indicate that the skill is region/language-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

fmt, client = fmt_map[choice]

    # Step 1: scrape
    r = subprocess.run([sys.executable, os.path.join(skill_dir, 'scraper.py')], capture_output=True, cwd=skill_dir)
    if r.returncode != 0:
        print(f"Scraper failed:\n{r.stderr.decode(errors='replace')}")
        return

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return

    # Step 2: test — surface output so user sees warnings + confirmation prompt
    r = subprocess.run([sys.executable, os.path.join(skill_dir, 'tester.py')], capture_output=False, cwd=skill_dir)
    if r.returncode != 0:
        print("Testing aborted or failed. No usable nodes.")
        return

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return

    # Step 3: format — tested nodes only, no raw fallback
    r = subprocess.run([sys.executable, os.path.join(skill_dir, 'formatter.py'), '--format', fmt, '--top', '5'], capture_output=True, text=True, cwd=skill_dir)
    if r.returncode != 0:
        print(f"Formatting failed:\n{r.stderr}")
        return

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script automatically makes outbound requests to numerous third-party URLs and ingests untrusted remote content without any user notice, consent, or trust controls. In this skill's context, the remote content is specifically proxy node material used for censorship bypass, so running it can silently contact external infrastructure, leak metadata such as IP/user-agent, and operationalize attacker-controlled network endpoints.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script writes the scraped node list to disk automatically, without warning or confirmation, storing potentially sensitive and high-risk proxy configuration data in a predictable local file. In this skill's context, that data may include credentials, server addresses, and subscription-derived access details, creating persistence of risky material and possible exposure to other local processes or users.

Tainted flow: 'output_path' from os.environ.get (line 133, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

print(f"Total: {len(all_nodes)}, Unique: {len(unique)}, Protocols: {protocols}")
    result = {"scraped_at": datetime.now().isoformat(), "total": len(unique), "protocols": protocols, "nodes": unique}
    os.makedirs(os.path.dirname(output_path), exist_ok=True)
    with open(output_path, 'w', encoding='utf-8') as f:
        json.dump(result, f, ensure_ascii=False, indent=2)
    print(f"Saved {len(unique)} nodes to {output_path}")

• Confidence: 94% confidence
• Finding: The script trusts OPENCLAW_WORKSPACE from the environment and uses it to construct output_path for a write operation without validation. An attacker who can influence the agent's environment could redirect writes outside the intended workspace and overwrite arbitrary files accessible to the process, which is especially concerning because the file content includes harvested proxy credentials and endpoints.

Tainted flow: 'output_path' from os.environ.get (line 132, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

"skipped": unsafe,
        "nodes": tested
    }
    with open(output_path, 'w', encoding='utf-8') as f:
        json.dump(result, f, ensure_ascii=False, indent=2)
    print(f"Saved to {output_path}")

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Static analysis

No suspicious patterns detected.