Vpn Rotator Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:29 AM UTC
• Version: 1.0.0

Overview

This VPN rotation skill is review-worthy because it asks for persistent passwordless sudo and stored VPN credentials while promoting IP rotation to bypass API rate limits.

Review this carefully before installing. Use it only for authorized VPN rotation workflows, avoid using it to bypass services' access controls or terms, do not copy-paste the sudoers command as written, and prefer a manually reviewed least-privilege setup with exact paths and validation. Treat ~/.vpn/creds.txt as a sensitive secret and avoid syncing or committing it.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:142

Finding

Unsafe Passwordless Sudo Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 142–147; repeated at lines 304–310
Vulnerability Type: Passwordless privileged command execution with malformed or unspecified executable paths
Risk Level: Medium

Vulnerable Code

bash

# Allow openvpn and killall to execute without a password
echo "$USER ALL=(ALL) NOPASSWD: /usr/s（请参考skill目录中的脚本文件）, /usr/（请参考skill目录中的脚本文件）" | sudo tee /etc/sudoers.d/openvpn

Technical Analysis

The Skill instructs users to create a system-wide sudoers fragment granting the current account passwordless execution as any user. The executable paths in the rule are corrupted placeholders rather than exact, validated paths to root-owned binaries. The command also installs the fragment directly without validating it with visudo.

This conflicts with the accompanying claim that only the OpenVPN and killall binaries are authorized. If a user replaces the placeholders with broad paths, writable executables, wrapper scripts, or commands with unsafe argument surfaces, the resulting rule may permit operations beyond VPN management.

Even a narrowly specified passwordless process-management command can present escalation opportunities if it accepts configuration files, plugins, scripts, environment-controlled resources, or other arguments that influence privileged behavior.

Attack Path

1. A user follows the Skill's setup instructions.
2. The user manually replaces the invalid placeholders with guessed or overly broad executable paths.
3. The generated rule is written directly to /etc/sudoers.d/openvpn without syntax or ownership validation.
4. A local process running under the authorized account invokes the permitted command through sudo without authentication.
5. If the permitted executable or its arguments allow loading attacker-controlled resources or performing unrestricted process operations, the attacker abuses that interface to perform privileged actio ...[truncated 787 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the blanket passwordless sudo setup from the general installation procedure.
• Prefer a root-owned service or narrowly scoped helper that exposes only validated VPN connect, disconnect, and status operations.
• If sudo is unavoidable, specify exact absolute paths to root-owned, non-writable executables.
• Restrict permitted arguments rather than allowing unrestricted invocation of OpenVPN or process-management utilities.
• Do not grant general passwordless access to killall; use a dedicated helper that can terminate only the VPN process it created.
• Create the fragment with root ownership and mode 0440.
• Generate the proposed rule in a temporary file and validate it using visudo -cf before installing it.
• Document a safe removal and recovery procedure.
• Replace both occurrences of the malformed command so users are not directed to insecure fallback instructions.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:343

Finding

Unpinned Third-Party Python Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 343–351
Vulnerability Type: Uncontrolled dependency resolution without version or integrity constraints
Risk Level: Low

Vulnerable Code

markdown

| Dependency | Type | Required | Installation |
|:------|------:|:------|:------|
| LLM API | API | Required | Provided by the Agent platform |
| OpenVPN | System software | Required | `apt install openvpn` / official download |
| requests | Python library | Recommended | `pip install requests` |
| psutil | Python library | Optional | `pip install psutil` |
| VPN provider account | Subscription | Required | ProtonVPN/NordVPN/Mullvad, etc. |

Technical Analysis

The installation instructions resolve the latest available requests and psutil releases without version constraints, cryptographic hashes, a lockfile, or an explicitly documented package index. Dependency resolution can therefore change over time and is not reproducible from the audited artifact.

Package installation executes package build and installation logic in the user's environment. If package resolution is redirected to an untrusted index, a future package release is compromised, or network and package-manager configuration is manipulated, unreviewed code may be installed and subsequently imported.

No malicious dependency, typographical package name, or compromised package version was identified in the project. The finding concerns the absence of supply-chain controls rather than evidence that the named packages are currently malicious.

Attack Path

1. A user follows the documented pip install command.
2. pip resolves a mutable package version using the environment's configured indexes and mirrors.
3. An attacker compromises an accepted distribution source, redirects package resolution through local configuration, or causes an unsafe future release to be selected.
4. The package manager downloads and installs the ...[truncated 883 chars]

Remediation

View remediation

Remediation Suggestions

• Pin reviewed dependency versions instead of installing unconstrained latest releases.
• Maintain a lockfile containing all direct and transitive dependencies.
• Require hashes for downloaded distributions, such as through a hash-locked requirements file.
• Explicitly use a trusted package index and prevent unintended fallback to unknown indexes.
• Install packages inside a dedicated virtual environment without root privileges.
• Prefer prebuilt, verified wheels where practical and review packages requiring local build execution.
• Add automated dependency vulnerability and integrity scanning.
• Document a controlled update process so pinned versions receive timely security patches.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Piping a generated sudoers rule into sudo tee is a classic chaining-abuse pattern because it combines shell expansion, privileged file write, and persistent policy change in one step. Within an exec-capable agent skill, this creates a dangerous bridge from ordinary workflow execution to durable privileged command execution over network-control operations.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

bash

# 允许openvpn和killall免密执行（VPN切换需要root权限）
echo "$USER ALL=(ALL) NOPASSWD: /usr/s（请参考skill目录中的脚本文件）, /usr/（请参考skill目录中的脚本文件）" | sudo tee /etc/sudoers.d/openvpn

第四步：使用装饰器自动轮换

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The FAQ reproduces the same chaining-abuse primitive, making it more likely users will copy-paste a privileged shell pipeline without scrutiny. Because the skill's purpose is automated VPN rotation with exec support, this persistence-enabling step materially increases the risk of abuse, accidental misconfiguration, and privilege expansion.

Content

Scanner excerpt · SKILL.md (reported line 309)May include surrounding context.

A：这是因为未配置免密sudo。运行以下命令配置：

bash

echo "$USER ALL=(ALL) NOPASSWD: /usr/s（请参考skill目录中的脚本文件）, /usr/（请参考skill目录中的脚本文件）" | sudo tee /etc/sudoers.d/openvpn

仅授权openvpn和killall两个命令的免密执行，安全性可控。

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly promotes rotating VPN IPs to evade API rate limits but does not include a clear warning about policy, legal, operational, and abuse risks. In this context, omission is security-relevant because the skill is designed to automate network identity changes and facilitate conduct that can bypass service protections.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

L018将“新增连接健康检查与自动重连机制”描述为该技能的差异化能力，但后文多处明确写明免费版“不支持自动重连”。这不是简单遗漏，而是文档内部对技能意图和实际可用能力的直接冲突，可能误导用户认为免费版具备断线自动恢复能力。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

L056明确标注“自动重连”免费版不支持，但L324再次列为免费版限制，说明文档整体是在表达该能力不可用；与L018的差异化描述形成直接矛盾。该冲突会影响使用者对技能边界和恢复能力的判断。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are overly broad ('API集成、接口对接、Webhook配置、系统连接时使用'), which increases the chance the skill activates in unrelated workflows. In context, this skill can initiate VPN switching and route changes, so accidental invocation could alter network behavior, disrupt traffic, or inappropriately steer users toward rate-limit evasion workflows.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

bash

# Linux (Ubuntu/Debian)
sudo apt install openvpn
# ...
# macOS
brew install openvpn

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Persisting both server configs and credentials in a predictable ~/.vpn directory creates durable local artifacts that can be harvested or reused. In a tool intended for automated repeated use, this persistence expands the blast radius of any local compromise and makes silent reuse easier.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

bash

# 创建VPN配置目录
mkdir -p ~/.vpn/servers
# ...
# 保存VPN账号密码
echo "your_username" > ~/.vpn/creds.txt

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Persisting both server configs and credentials in a predictable ~/.vpn directory creates durable local artifacts that can be harvested or reused. In a tool intended for automated repeated use, this persistence expands the blast radius of any local compromise and makes silent reuse easier.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

bash

# 创建VPN配置目录
mkdir -p ~/.vpn/servers
# ...
# 保存VPN账号密码
echo "your_username" > ~/.vpn/creds.txt

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md

# 保存VPN账号密码
echo "your_username" > ~/.vpn/creds.txt
echo "your_password" >> ~/.vpn/creds.txt
chmod 600 ~/.vpn/creds.txt
# ...
# 下载VPN服务器配置文件（.ovpn）到 ~/.vpn/servers/
# ProtonVPN/NordVPN/Mullvad等均提供OpenVPN配置文件

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

This section instructs users to configure passwordless sudo for VPN switching, which materially lowers privilege barriers for subsequent execution. In an agent skill with exec capability, establishing NOPASSWD paths for network-control commands increases the chance that future agent-driven or chained commands can manipulate the host's networking without meaningful user mediation.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

ProtonVPN/NordVPN/Mullvad等均提供OpenVPN配置文件

text

### 第三步：配置免密sudo

```bash
# 允许openvpn和killall免密执行（VPN切换需要root权限）

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The command pipes generated content directly into sudo tee to create a sudoers file granting NOPASSWD execution. In this skill's context, that is highly dangerous because it programmatically changes host privilege policy, enabling later privileged network process control and creating a strong pivot for command chaining or misuse by the agent or copied scripts.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

bash

# 允许openvpn和killall免密执行（VPN切换需要root权限）
echo "$USER ALL=(ALL) NOPASSWD: /usr/s（请参考skill目录中的脚本文件）, /usr/（请参考skill目录中的脚本文件）" | sudo tee /etc/sudoers.d/openvpn

第四步：使用装饰器自动轮换

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 287)May include surrounding context.

md

| 错误类型 | 原因 | 恢复策略 |
|:---:|:---:|:---:|
| sudo密码提示 | 未配置免密sudo | 运行配置脚本或手动添加sudoers |
| 连接失败 | 凭证错误或服务器不可用 | 检查凭证，尝试其他服务器 |
| 仍被封锁 | API封锁了VPN IP段 | 降低rotate_every，增大delay |
| 无.ovpn文件 | 未下载服务器配置 | 从VPN服务商官网下载配置文件 |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

This FAQ repeats the unsafe recommendation to create a passwordless sudoers entry via shell pipeline. Repetition increases the likelihood of adoption, and in an exec-enabled skill centered on changing network state, it meaningfully expands the attack surface by normalizing persistent privileged execution for agent-orchestrated actions.

Content

Scanner excerpt · SKILL.md (reported line 309)May include surrounding context.

A：这是因为未配置免密sudo。运行以下命令配置：

bash

echo "$USER ALL=(ALL) NOPASSWD: /usr/s（请参考skill目录中的脚本文件）, /usr/（请参考skill目录中的脚本文件）" | sudo tee /etc/sudoers.d/openvpn

仅授权openvpn和killall两个命令的免密执行，安全性可控。

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

L018 明确写明“重新设计中文交互流程”，而文档中未见任何可选语言、地区选择或用户 opt-in 说明。根据语言/locale 政策，这属于默认强制特定语言的自然语言约束，尤其该技能面向多平台 Agent 使用时更明显。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.