Security audit

URnetwork

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate proxy-network skill, but it tells agents to obtain and reuse a sensitive account token without enough handling limits.

Only install this if you trust URnetwork/bringyour.com with proxy account access. Treat the auth code and JWT as credentials: do not paste them into untrusted chats or logs, prefer temporary/session-only storage, and review any request to enable WireGuard because it can route all traffic through the proxy.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (15)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly instructs agents to obtain a user JWT, send it in Authorization headers, and states that the JWT can be stored and reused, but it provides no warning about secure storage, minimization, redaction, or scope handling for bearer tokens. In an agent context, reusable bearer tokens are highly sensitive secrets; weak handling can lead to account takeover or unauthorized proxy use if logs, memory, prompts, or downstream tools expose them.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: This instruction directs the agent to transmit a human-provided auth code to an external service in order to mint a reusable JWT. External transmission of authentication material is expected for the service to function, but in a skill context it is still security-relevant because it normalizes sending secrets off-platform without any trust, consent, domain-validation, or redaction guidance.
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
When using the API or MCP server, the user JWT must be passed in an Authorization: Bearer <JWT> header.

To get the JWT, ask the human for an auth code, and then convert that auth code to a JWT using the API /auth/code-login route. An example curl is below, piped to jq to extract the by_jwt property from the result:

text
curl -X POST https://api.bringyour.com/auth/code-login -d '{"auth_code": "<AUTH CODE>"}' | jq ".by_jwt"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
To get the JWT, ask the human for an auth code, and then convert that auth code to a JWT using the API /auth/code-login route. An example curl is below, piped to jq to extract the by_jwt property from the result:

text
curl -X POST https://api.bringyour.com/auth/code-login -d '{"auth_code": "<AUTH CODE>"}' | jq ".by_jwt"

The JWT can be stored and reused. If the human asks to refresh the JWT, repeat the process starting with asking for an auth code.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
To get the JWT, ask the human for an auth code, and then convert that auth code to a JWT using the API /auth/code-login route. An example curl is below, piped to jq to extract the by_jwt property from the result:

text
curl -X POST https://api.bringyour.com/auth/code-login -d '{"auth_code": "<AUTH CODE>"}' | jq ".by_jwt"

The JWT can be stored and reused. If the human asks to refresh the JWT, repeat the process starting with asking for an auth code.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
To get the JWT, ask the human for an auth code, and then convert that auth code to a JWT using the API /auth/code-login route. An example curl is below, piped to jq to extract the by_jwt property from the result:

text
curl -X POST https://api.bringyour.com/auth/code-login -d '{"auth_code": "<AUTH CODE>"}' | jq ".by_jwt"

The JWT can be stored and reused. If the human asks to refresh the JWT, repeat the process starting with asking for an auth code.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
To get the JWT, ask the human for an auth code, and then convert that auth code to a JWT using the API /auth/code-login route. An example curl is below, piped to jq to extract the by_jwt property from the result:

text
curl -X POST https://api.bringyour.com/auth/code-login -d '{"auth_code": "<AUTH CODE>"}' | jq ".by_jwt"

The JWT can be stored and reused. If the human asks to refresh the JWT, repeat the process starting with asking for an auth code.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
To get the JWT, ask the human for an auth code, and then convert that auth code to a JWT using the API /auth/code-login route. An example curl is below, piped to jq to extract the by_jwt property from the result:

text
curl -X POST https://api.bringyour.com/auth/code-login -d '{"auth_code": "<AUTH CODE>"}' | jq ".by_jwt"

The JWT can be stored and reused. If the human asks to refresh the JWT, repeat the process starting with asking for an auth code.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
To get the JWT, ask the human for an auth code, and then convert that auth code to a JWT using the API /auth/code-login route. An example curl is below, piped to jq to extract the by_jwt property from the result:

text
curl -X POST https://api.bringyour.com/auth/code-login -d '{"auth_code": "<AUTH CODE>"}' | jq ".by_jwt"

The JWT can be stored and reused. If the human asks to refresh the JWT, repeat the process starting with asking for an auth code.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
To get the JWT, ask the human for an auth code, and then convert that auth code to a JWT using the API /auth/code-login route. An example curl is below, piped to jq to extract the by_jwt property from the result:

text
curl -X POST https://api.bringyour.com/auth/code-login -d '{"auth_code": "<AUTH CODE>"}' | jq ".by_jwt"

The JWT can be stored and reused. If the human asks to refresh the JWT, repeat the process starting with asking for an auth code.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.
To get the JWT, ask the human for an auth code, and then convert that auth code to a JWT using the API /auth/code-login route. An example curl is below, piped to jq to extract the by_jwt property from the result:

text
curl -X POST https://api.bringyour.com/auth/code-login -d '{"auth_code": "<AUTH CODE>"}' | jq ".by_jwt"

The JWT can be stored and reused. If the human asks to refresh the JWT, repeat the process starting with asking for an auth code.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
The API can be used directly to create a HTTPS/SOCKS/WireGuard proxy for a country.

Step 1, search for a list of locations using the route /network/find-locations. A curl example is below, piped to jq to extract the locations list.

text
curl -X POST -H 'Authorization: Bearer <JWT>' https://api.bringyour.com/network/find-locations -d '{"query": "<LOCATION NAME>"}' | jq '.locations'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
Step 3, create a proxy using the saved country code using the /network/auth-client route and setting the proxy_config.initial_device_state to have country_code.

text
curl -X POST -H 'Authorization: Bearer <JWT>' https://api.bringyour.com/network/auth-client -d '{"proxy_config": {"initial_device_state": {"country_code": "<COUNTRY CODE>"}}}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
Step 3, create a proxy using the saved location_id using the /network/auth-client route and setting the the proxy_config.initial_device_state.location to have connect_location_id.location_id.

text
curl -X POST -H 'Authorization: Bearer <JWT>' https://api.bringyour.com/network/auth-client -d '{"proxy_config": {"initial_device_state": {"location": {"connect_location_id":{"location_id": "<LOCATION ID>"}}}}}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.
Step 2, choose the location of interest and save the location_id.

Step 3, fetch a ranked list of providers (egress IPs) for the location_id using the route /network/find-providers2. The sample size can be set to however many unique providers are needed. A curl example is below, piped to jq to extract the providers list.

text
curl -X POST -H 'Authorization: Bearer <JWT>' https://api.bringyour.com/network/find-providers2 -d '{"specs": [{"client_id": "<CLIENT ID>"}], "count": <COUNT>}' | jq '.providers'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.
Step 4, by looping over each client_id in the list, create a proxy using the client_id using the /network/auth-client route and setting the the proxy_config.initial_device_state.location to have connect_location_id.client_id.

text
curl -X POST -H 'Authorization: Bearer <JWT>' https://api.bringyour.com/network/auth-client -d '{"proxy_config": {"initial_device_state": {"location": {"connect_location_id":{"client_id": "<CLIENT ID>"}}}}}'

Static analysis

No suspicious patterns detected.