Tailscale Serve

Security checks across malware telemetry and agentic risk

Overview

This is a simple Tailscale Serve guide that can expose chosen local files or services to a Tailscale network, which is disclosed and central to its purpose.

Install only if you want an agent to help manage Tailscale Serve. Before running examples, verify the exact file, folder, or port, avoid serving sensitive directories or unauthenticated admin tools, check `tailscale serve status`, and remove or reset routes when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill provides direct commands to expose local directories, files, and localhost services over Tailscale without any warning about access scope, sensitive data exposure, or the risk of unintentionally publishing internal applications. Even though Tailscale access is not fully public by default, the commands materially increase exposure of local resources and could lead users to share confidential content or admin interfaces without understanding the consequences.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal