ProxyClaw

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:38 PM UTC
• Version: 2.5.2

Overview

This skill is a real residential-proxy tool, but it asks for broad scraping and long-running network participation with under-disclosed security and privacy risks.

Install only if you deliberately want a residential proxy/scraping tool and understand that use may affect third-party sites, your account quota, and your network reputation. Do not run the rewards Docker node on a personal or sensitive machine without isolating it, pinning/verifying the image, monitoring bandwidth, and knowing how to stop and remove it. Treat IPLOOP_API_KEY and browser tokens as secrets; avoid storing them in localStorage, shell profiles, or plaintext .env downloads when possible, and rotate them if exposed.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T06 · System Persistence

Error

• Location: SKILL.md:234
• Finding: Persistent Third-Party Residential Proxy Node<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:234-239` **Additional Locations**: `README.md:177-183`, `REWARDS.md:43-51`, `earn/DOCKER.md:5-20`, `earn/NODE-AGENT.md:9-25` **Vulnerability Type**: Persistent externally controlled network service **Risk Level**: High ### Vulnerable Code ```bash ## 🐳 Earn Free Proxy Credits Share unused bandwidth → earn proxy credits. **1 GB shared = 1 GB of proxy access.** docker run -d --name iploop-node --restart=always ultronloop2026/iploop-node:latest ``` The Docker Compose instructions provide equivalent persistence: ```yaml services: iploop-node: image: ultronloop2026/iploop-node:latest container_name: iploop-node restart: always ``` ### Technical Analysis The documented command starts a detached third-party container with an `always` restart policy. The node connects to `gateway.iploop.io` and relays third-party HTTP/HTTPS proxy requests through the user's residential Internet connection. The restart policy causes the service to resume after Docker daemon restarts and system reboots. This behavior crosses session boundaries and is not necessary for the Skill's primary declared function of fetching user-selected URLs through an upstream proxy. Although the bandwidth-sharing feature is described as opt-in, its security consequences are understated. The bundled documentation claims that the node is safe and cannot access local resources, but the reviewed repository does not contain the node implementation or image definition needed to verify those claims. ### Attack Path 1. A user or Agent follows the prominently advertised “earn credits” instructions. 2. Docker retrieves the externally maintained `ultronloop2026/iploop-node:latest` image. 3. The container starts in the background and connects to the IPLoop gateway. 4. The gateway assigns third-party proxy traffic to the node. 5. That traffic exits through the user's public residential IP address. 6. The `--restart=always` policy r ...[truncated 943 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove bandwidth-sharing installation instructions from the core URL-fetching Skill and distribute the node as a separate, explicitly selected product. 2. Do not use `--restart=always` by default. Prefer no restart policy or `--restart=on-failure` with a bounded retry count. 3. Require explicit informed consent before installation, clearly explaining that arbitrary third-party traffic will exit through the user's IP address. 4. Document complete shutdown and removal commands: ```bash docker stop iploop-node docker rm iploop-node docker image rm ultronloop2026/iploop-node ``` 5. Apply CPU, memory, process, and bandwidth limits. 6. Publish the container source, build process, security model, destination restrictions, and independent audit results. 7. Restrict relay destinations and block loopback, link-local, private, metadata-service, and other sensitive address ranges. 8. Provide transparent traffic accounting, abuse controls, revocation, and an emergency kill switch. ]]>

T08 · Insecure Dependencies

Error

• Location: earn/NODE-AGENT.md:9
• Finding: Unverified Mutable Container and Standalone Executables<: | Platform | Binary | |----------|--------| | Linux amd64 | `iploop-node-linux-amd64` | | Linux arm64 | `iploop-node-linux-arm64` | | macOS Intel | `iploop-node-darwin-amd64` | | macOS ARM | `iploop-node-darwin-arm64` | | Windows x64 | `iploop-node-windows-amd64.exe` | | Raspberry Pi | `iploop-node-linux-armv7` | ```bash chmod +x iploop-node-linux-amd64 ./iploop-node-linux-amd64 ``` ``` The package installation guidance is similarly unpinned: ```bash pip install iploop-sdk npm install iploop ``` ### Technical Analysis The instructions execute the mutable `latest` container tag without pinning an immutable image digest. A `latest` tag can be replaced after the Skill has been reviewed, meaning future installations may execute different code. The standalone executable workflow instructs users to download, mark executable, and run release binaries without providing checksum or signature verification. The repository under audit does not contain those binaries, so their behavior cannot be established through this audit. Python and Node.js SDK installation commands also omit exact versions and integrity constraints. This broadens the supply-chain exposure, although the highest risk comes from the persistent node container and standalo ...[truncated 1407 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the container to an immutable digest: ```bash docker run ... ultronloop2026/iploop-node@sha256:VERIFIED_DIGEST ``` 2. Publish SHA-256 hashes and cryptographic signatures for every platform binary. 3. Require signature and checksum verification before `chmod +x` or execution. 4. Use reproducible builds and publish provenance attestations such as SLSA metadata. 5. Pin Python and npm dependencies to audited versions and use hash-locked dependency files. 6. Add automated vulnerability, malware, and provenance scanning to the release pipeline. 7. Use a dedicated non-root user and a hardened container configuration: - Read-only root filesystem. - Dropped Linux capabilities. - `no-new-privileges`. - Seccomp/AppArmor/SELinux profile. - Resource and egress limits. 8. Avoid automatic persistent restart for externally retrieved executable components. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: fetch.sh:67
• Finding: Proxy API Key Exposed Through Process Arguments and Plaintext Proxy Authentication<![CDATA[ ## Vulnerability Details **File Location**: `fetch.sh:67-94` **Additional Location**: `setup.sh:19-27`, `SKILL.md:34-43,82-85` **Vulnerability Type**: Insecure secret transmission and process-level secret exposure **Risk Level**: High ### Vulnerable Code ```bash # ── API key check ── if [ -z "${IPLOOP_API_KEY:-}" ]; then echo "Error: IPLOOP_API_KEY not set." >&2 echo "Get your free key at https://iploop.io/signup.html" >&2 echo "Then: export IPLOOP_API_KEY=\"your_key\"" >&2 exit 1 fi # ── Build proxy auth ── AUTH="iploop:${IPLOOP_API_KEY}" [ -n "$COUNTRY" ] && AUTH="${AUTH}-country-${COUNTRY}" [ -n "$CITY" ] && AUTH="${AUTH}-city-${CITY}" [ -n "$SESSION_ID" ] && AUTH="${AUTH}-session-${SESSION_ID}" [ -n "$ASN" ] && AUTH="${AUTH}-asn-${ASN}" # ── Temp file with guaranteed cleanup ── TMPFILE=$(mktemp) trap 'rm -f "$TMPFILE"' EXIT # ── Fetch ── CURL_OUT=$(curl -s -o "$TMPFILE" -w "%{http_code} %{content_type}" \ --max-time "$TIMEOUT" \ --proxy "http://proxy.iploop.io:8880" \ --proxy-user "$AUTH" \ -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36" \ -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" \ -H "Accept-Language: en-US,en;q=0.9" \ "$URL" 2>/dev/null) || { ``` The Skill's security table states: ```markdown | **Secrets handling** | API key passed via `--proxy-user` (not in URL or command line args visible in `ps aux`) | | **Proxy transport** | HTTP proxy protocol — key is encrypted via HTTPS CONNECT tunnel to HTTPS targets | ``` ### Technical Analysis The API key is expanded into the argument supplied to `curl --proxy-user`. Despite the documentation's claim, this is a command-line argument and may be visible through process inspection facilities while `curl` is running, depending on operating-system permissions and process isolation. The proxy endpoint uses `http://proxy.iploop.io:8880`. For HTTP ...[truncated 1752 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Provide and require a TLS-protected HTTPS proxy endpoint. 2. Do not pass reusable secrets directly through command-line arguments. 3. Use a permission-restricted curl configuration or credential helper that prevents the secret from appearing in argv. 4. Use short-lived, narrowly scoped proxy tokens rather than long-lived API keys. 5. Rotate exposed credentials and support immediate revocation. 6. Correct the security documentation; do not claim that `--proxy-user` is invisible in process listings. 7. Explicitly distinguish target HTTPS encryption from client-to-proxy transport encryption. 8. Add tests that inspect process arguments and packet captures to verify the intended secret-handling guarantees. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: signup.html:254
• Finding: Long-Lived Tokens and API Keys Stored in Browser Local Storage and Plaintext Files<![CDATA[ ## Vulnerability Details **File Location**: `signup.html:254-277` **Additional Locations**: `signup.html:331-352`, `rules/setup.md:13-21` **Vulnerability Type**: Persistent plaintext credential storage **Risk Level**: Medium ### Vulnerable Code ```javascript // Success — save user data userData.customerId = data.user ? data.user.id : ''; userData.token = data.token; // Generate API key const keyRes = await fetch(API + '/api/v1/auth/api-keys', { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + data.token }, body: JSON.stringify({ name: 'default', permissions: ['proxy'] }) }); const keyData = await keyRes.json(); userData.apiKey = keyData.apiKey ? keyData.apiKey.key : 'Check dashboard'; // Show success panel showSuccessPanel(); // Save for dashboard localStorage.setItem('iploop_api_key', userData.apiKey); localStorage.setItem('iploop_token', userData.token); localStorage.setItem('iploop_email', data.user ? data.user.email : ''); localStorage.setItem('iploop_customer_id', userData.customerId); ``` The setup guide also recommends plaintext persistence: ```bash export IPLOOP_API_KEY="your_api_key_here" # To make it permanent, add to your shell profile: echo 'export IPLOOP_API_KEY="your_api_key"' >> ~/.bashrc source ~/.bashrc ``` The signup page can additionally create an unprotected credential file: ```javascript const blob = new Blob([envContent], { type: 'text/plain' }); const url = URL.createObjectURL(blob); const a = document.createElement('a'); a.href = url; a.download = 'iploop-credentials.env'; a.click(); URL.revokeObjectURL(url); ``` ### Technical Analysis `localStorage` is readable by any JavaScript executing under the same origin. Storing a bearer token and API key there increases the impact of any same-origin cross-site scripting vulnerability or compromised third-party script. The downloaded `.env` file and shell-profile recommendation store reusable API credentials in plaintext. No ...[truncated 1468 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not store bearer tokens or API keys in `localStorage`. 2. Store browser sessions in short-lived `HttpOnly`, `Secure`, and appropriate `SameSite` cookies. 3. Keep proxy API keys server-side and reveal them only when explicitly requested. 4. Use short expiration periods, narrow scopes, rotation, and immediate revocation. 5. Adopt a strict Content Security Policy and eliminate inline event handlers to reduce XSS exposure. 6. Use an operating-system credential store for command-line clients. 7. If a credential file must be created, instruct users to apply restrictive permissions: ```bash chmod 600 iploop-credentials.env ``` 8. Warn users not to commit `.env` files, include an appropriate `.gitignore`, and provide secure deletion and rotation instructions. 9. Avoid placing reusable secrets directly in shell profiles. ]]>

T07 · Tool Hijacking and Spoofing

Warning

• Location: signup.html:359
• Finding: Connection Test Fabricates a Successful Result Without Network Validation<![CDATA[ ## Vulnerability Details **File Location**: `signup.html:359-385` **Vulnerability Type**: Spoofed connectivity and security validation **Risk Level**: Medium ### Vulnerable Code ```javascript async function testConnection() { const btn = document.getElementById('test-btn'); const result = document.getElementById('test-result'); btn.disabled = true; btn.textContent = 'Testing...'; result.className = 'test-result'; result.style.display = 'none'; try { // Use a test endpoint through the proxy const proxyUrl = `http://${userData.customerId}:${userData.apiKey}@proxy.iploop.io:8880`; // For demo purposes, simulate the test (in production, make actual request) // const response = await fetch('https://httpbin.org/ip', { proxy: proxyUrl }); // Simulated success for now - replace with actual proxy test await new Promise(r => setTimeout(r, 1500)); result.className = 'test-result success'; result.innerHTML = ` <h4><span class="status-icon">✅</span> Connection Successful</h4> <p><strong>IP:</strong> 104.23.145.67</p> <p><strong>Country:</strong> United States</p> <p><strong>Latency:</strong> 142ms</p> <p style="margin-top: 12px; color: #00ff88;">Your proxy is working correctly!</p> `; ``` ### Technical Analysis The function constructs a proxy URL but never uses it. The only actual operation is a 1.5-second delay, after which it displays hard-coded IP address, country, latency, and success information. Browser `fetch` does not support the commented `{ proxy: proxyUrl }` option in normal web-page JavaScript, so simply uncommenting that line would not provide a valid implementation. A backend validation service or supported client mechanism is required. This behavior spoofs a legitimate-looking diagnostic tool and can cause users to trust credentials or network configuration that have never been tested. ### Attack Path 1. The user creates an account or receives displayed crede ...[truncated 894 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the test control until a real validation mechanism exists. 2. If retained for demonstration, label it prominently as simulated and never display “Connection Successful.” 3. Implement testing through a trusted server-side endpoint that attempts an authenticated proxy request and returns measured results. 4. Bind the response to the current user and protect the endpoint against SSRF, replay, and credential leakage. 5. Return success only after verifying: - Proxy authentication. - Expected egress IP or country. - Actual measured latency. - A valid response from a controlled test destination. 6. Avoid embedding credentials in URLs and redact secrets from logs and error messages. 7. Add automated negative tests using invalid credentials and unreachable proxies to ensure failure is reported correctly. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (98)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The description presents the skill as a residential proxy service for routing arbitrary requests through rotating residential IPs. The supplied code instead performs a search query using a SERP-specific API exposed by the IPLoop client and outputs search results. While this may indirectly rely on IPLoop infrastructure, the observable behavior is not general proxy access, request routing, IP rotation management, or geo-restriction bypass for arbitrary traffic. The primary purpose of the code chunk is search retrieval, which is a materially different capability from the declared proxy-access description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The description markets the skill as a residential proxy access service, implying a generic networking/proxy utility. The supplied code is not a general proxy-access wrapper; it is a specific scraper/test harness that targets many named websites, fetches their content, and extracts data such as titles, prices, posts, stock prices, and company info. While use of the IPLoop proxy is consistent with the product theme, the primary implemented behavior is automated browsing/scraping and proxy QA validation across external services. That is a materially different and broader capability than the declared description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: There is a clear description-behavior mismatch. The declared purpose is a residential proxy access skill for routing agent traffic through a large global proxy network. The supplied code does not implement any proxying, request forwarding, IP selection, rotation, authentication to a proxy backend, or bandwidth-sharing features. Instead, it runs a lightweight HTTP server that returns canned support answers based on keyword matching. While the chatbot content discusses IPLoop and ProxyClaw features, the actual behavior is informational customer support, not the advertised proxy capability. This is a materially different primary purpose.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

# 🌐 ProxyClaw by IPLoop

**This is an action skill.** When a user asks to fetch a URL, scrape a site, or use a proxy — execute the request yourself and return the result. Do not just show instructions.

**Expected behaviour:**
- Call `./fetch.sh <URL> [--country CC] [--format markdown]` yourself and return the content

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill explicitly directs agents to scrape arbitrary sites through residential proxies and return results, but provides no compliance, privacy, or data-handling guardrails. Residential proxies materially raise abuse potential by masking origin, bypassing geo-controls, and enabling collection of third-party content or personal data at scale, making this context more dangerous than ordinary fetching.

External Script Fetching

High

• Category: Supply Chain

Content

### POST /auth/register
```bash
curl -X POST https://api.iploop.io/api/v1/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email": "[e-mail]", "password": "Pass123!", "firstName": "John", "lastName": "Doe", "company": "Acme"}'
```

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

-d '{"name": "My Server", "deviceType": "linux"}'
```

### DELETE /earn/devices/:id
Remove a device.

### GET /earn/cashout/history

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# 1. Register
TOKEN=$(curl -s -X POST https://api.iploop.io/api/v1/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email":"[e-mail]","password":"Pass123!","firstName":"Bot","lastName":"Agent"}' \
  | python3 -c "import json,sys; print(json.load(sys.stdin)['token'])")

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

docker logs iploop-node

# Check gateway sees your node
curl -s https://gateway.iploop.io:9443/health | python3 -m json.tool
```

## Check Your Earnings

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

docker logs iploop-node

# Check gateway sees your node
curl -s https://gateway.iploop.io:9443/health | python3 -m json.tool
```

## Check Your Earnings

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Login first
TOKEN=$(curl -s -X POST https://api.iploop.io/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"[e-mail]","password":"YourPass"}' \
  | python3 -c "import json,sys; print(json.load(sys.stdin)['token'])")

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

s

- `curl` installed (comes pre-installed on most systems)
- `IPLOOP_API_KEY` environment variable set

## Getting Your API Key

1. Sign up at [iploop.io/signup](https://iploop.io/signup.html)
2. Copy your API key from the dashboard
3. Use code **`OPENCLAW`** for 20% off any paid plan

```bash
export IPLOOP_API_KEY="your_api_key_here"
```

To make it permanent, add to your shell profile:
```bash
echo 'export IPLOOP_API_KEY="your_api_key"' >> ~/.bashrc
source ~/.bashrc
```

## Verify Connection

```bash
./setup.sh
```

Expected output:
```
✅ IPLOOP_API_KEY is set
✅ Proxy connection successful
✅ ProxyClaw is ready
```

## Markdown Output

For markdown-formatted output, install:
```bash
npm install -g node-html-markdown
```

Then use:
```bash
./fetch.sh https://example.com --format markdown
```

## Proxy Endpoint

All requests route through: `proxy.iploop.io:8880`

Format: `http://iploop:API_KEY[-options]@proxy.iploop.io:8880`

## Troubleshooting

### Connection timeout
- Check if

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Hidden Instructions

High

• Category: Prompt Injection

Content

<div class="feat"><div class="num">~70 GB</div><div class="label">Earn Monthly</div></div>
  </div>

  <!-- STEP 1: Signup Form -->
  <div class="card" id="signup-form">
    <span class="free-badge">✨ 0.5 GB Free — No Credit Card</span>
    <h2>Create Your Account</h2>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Credential Access

High

• Category: Privilege Escalation

Content

<strong>✨ New:</strong> Single API key format — no more customer_id needed! Just copy your key and go.
    </div>

    <button class="btn btn-secondary" onclick="downloadEnv()">📥 Download .env file</button>

    <h3 style="color: #fff; margin: 32px 0 16px; font-size: 16px;">Choose your integration:</h3>

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The page stores the API key and auth token in `localStorage`, where they are accessible to any script running in the origin, including injected JavaScript from XSS or compromised third-party content. Persisting long-lived secrets this way materially increases the blast radius of any client-side compromise.

Credential Access

High

• Category: Privilege Escalation

Content

const url = URL.createObjectURL(blob);
  const a = document.createElement('a');
  a.href = url;
  a.download = 'iploop-credentials.env';
  a.click();
  URL.revokeObjectURL(url);
}

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README promotes automatic anti-bot bypass, stealth mode, and scraping of protected sites without any warning about legal, privacy, terms-of-service, or abuse implications. In an agent skill context, this can normalize automated evasion behavior and encourage deployment against targets that did not consent to such access.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Gateway Health
```bash
curl https://gateway.iploop.io:9443/health
# → {"connected_nodes": 23000+, "status": "healthy"}
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The README tells users to run a persistent Docker node to 'share bandwidth' for credits, but does not clearly disclose the security, privacy, abuse-reporting, IP reputation, bandwidth-cost, and resource-consumption risks. This is especially dangerous because it encourages 24/7 operation of software that routes third-party traffic through the user's environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The README instructs users to run a Docker image with the mutable `:latest` tag and without a pinned digest, which creates a software supply-chain risk. If the upstream image is replaced, compromised, or changed unexpectedly, users may execute unreviewed code on persistent hosts with network access.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation states that the agent connects automatically to `gateway.iploop.io` and then earns credits by remaining online, but it does not clearly warn users that they are enabling ongoing external communications from their system. Because this skill is specifically about residential proxy access and bandwidth contribution, the omitted warning is more dangerous than in ordinary software docs: users may unknowingly expose their device/network to continuous participation in a proxy network.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The quick-start instructions tell users to run a persistent container with `--restart=always` but do not warn about continuous CPU, memory, disk, bandwidth, and security implications of a long-running background service. In the context of a residential proxy node, persistent execution is especially sensitive because the host may continuously contribute network reputation and bandwidth for other parties' traffic.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The Docker command uses the mutable `latest` tag instead of a pinned version or image digest, which makes the executed code non-reproducible and allows upstream image changes to alter behavior without notice. In a skill that encourages users to run a long-lived networked node, this increases supply-chain risk substantially because a compromised or replaced image could gain persistent execution on the host.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises and instructs use of shell execution, network access, and environment-variable handling, but does not declare an explicit tool/permission scope. That makes the effective privilege boundary unclear and increases the chance an agent invokes this skill with broader capabilities than intended, especially given the skill's instruction to execute requests directly on behalf of the user.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The activation text is very broad: any request to fetch a URL, scrape a site, or use a proxy should be executed directly. That encourages automatic invocation for common browsing tasks without meaningful user confirmation, policy checks, or domain restrictions, increasing the risk of SSRF-like access patterns, unintended third-party requests, or abusive scraping via the agent.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: signup.html:242