Security audit

VPN Tunnel

Security checks for vulnerabilities and agentic risk

Overview

This VPN skill is purpose-aligned overall, but it embeds passwords and automates privileged network changes, so users should review it carefully before installing.

Install only if you understand and control the referenced VPS and WireGuard setup. Rotate the exposed credentials, replace hardcoded passwords with interactive sudo or a secret manager, use SSH keys instead of sshpass, require confirmation before starting the tunnel, and make external connectivity tests opt-in.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill invokes shell commands to start and stop networking components, but the manifest does not declare any permissions or clearly signal that privileged local command execution is required. This weakens security review and user consent because a networking skill can run system-level actions without explicit capability disclosure.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The finding indicates the skill behavior exceeds its stated purpose by embedding plaintext credentials, using sshpass for automated SSH login, and contacting external services not disclosed in the description. Hardcoded authentication material is especially dangerous because it enables credential theft, unauthorized VPS access, and silent external communications that users and reviewers are not expecting.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script hard-codes both a sudo password and SSH password, then uses them to obtain local privileged access and remote access to a VPS. Embedding reusable credentials in a skill is dangerous because anyone with access to the file can recover them, reuse them outside the intended workflow, and potentially pivot into the local host or the remote server.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The script claims to wait for a WireGuard handshake, but it only loops and breaks on success without failing if no handshake is ever established. It then proceeds to start the SOCKS proxy anyway, which can route traffic through the remote VPS even when the expected tunnel state is absent, creating misleading security assumptions and possible traffic exposure outside the intended path.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger phrases include broad requests such as 'use VPN', 'connect to VPN', 'change IP', or 'access international sites', which can cause the skill to activate in situations the user did not specifically intend. Because this skill changes network routing behavior and connects to an external VPS, accidental activation increases the chance of unnecessary proxying, privacy exposure, or use of sensitive infrastructure.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The script contains a hardcoded sudo password and pipes it into `sudo -S` to run `wg show` with elevated privileges. Embedding credentials in a script is a serious secret-handling flaw: anyone who can read the file, logs, backups, or process context may recover the password and potentially reuse it for broader privilege escalation on the host.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The script performs live network requests to external sites (`google.com` and `github.com`) as a 'quick test' without explicit disclosure or opt-in at runtime. While not inherently privilege-escalating, this leaks usage metadata to third parties, may violate user expectations in a sensitive VPN context, and can create unintended outbound traffic from restricted environments.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The script uses a hardcoded SSH password with sshpass to establish unattended remote access, with no disclosure or consent prompt to the user. This creates covert credentialed connectivity to a specific external host and makes compromise of the script equivalent to compromise of the remote account.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The script forcefully kills matching SSH processes based on a broad command-line pattern without warning or confirmation. This can terminate unrelated user sessions or security-relevant tunnels that happen to match, causing denial of service or disrupting other workflows.

Static analysis

No suspicious patterns detected.