ClawHub
Back to skill

Security audit

Protonvpn Openvpn

Security checks across malware telemetry and agentic risk

Overview

This VPN management skill is coherent, but it recommends broad passwordless sudo and uses writable /tmp state for privileged network-control commands.

Review the sudo setup before installing. Prefer a tightly scoped root-owned helper or sudoers rules limited to exact OpenVPN config paths and safe disconnect behavior. Be aware that status checks contact ipinfo.io and reveal the active public IP/location metadata to that service.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs users to query ipinfo.io to verify VPN status, which discloses the host's current public IP address, rough geolocation, and request metadata to a third-party service. In a privacy-focused VPN skill, this creates a meaningful privacy leak because verification depends on external network telemetry without an explicit warning or self-hosted/local alternative.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
- OpenVPN installed (`openvpn` binary in PATH)
- ProtonVPN config files in `/etc/openvpn/client/`
- Auth credentials file at `/etc/openvpn/client/auth.txt` (chmod 600)
- Passwordless sudo for `openvpn` and `kill` commands (recommended)

## Available Configs
Confidence
92% confidence
Finding
sudo

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# Use a state file to track current position: /tmp/vpn-rotation-state

# 3. Connect to next
sudo openvpn --config /etc/openvpn/client/<next>.protonvpn.udp.ovpn --daemon --log-append /tmp/openvpn.log --writepid /tmp/openvpn.pid
sleep 5

# 4. Verify
Confidence
89% confidence
Finding
sudo

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.