X-VPN MCP Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:56 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for VPN-based geo access, but its installer tells users to run an unverified remote shell script that can install a daemon and change agent wiring.

Review this before installing. Normal VPN use is clearly described and scoped, but do not run the one-line installer unless you trust the X-VPN distribution endpoint and accept that it may install a daemon and modify local agent configuration. A safer installer would provide a versioned download plus checksum or signature verification before execution.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:73

Finding

Unverified Remote Installer Downloaded and Executed by a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 73
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Complete Code Snippet:

sh

sh <(curl -sSf https://app.xvpncdn.com/rpc788pbdq/install.sh)

Technical Analysis

The installation instruction uses shell process substitution to download content from an external URL and pass it directly to sh. The remote payload is not pinned to an immutable version, verified against a cryptographic checksum, or authenticated with a signature. It is also absent from the audited project, so its behavior cannot be established through review of this repository.

HTTPS protects the connection in transit under normal conditions, but it does not prevent the server operator, a compromised hosting account, or a compromised release pipeline from changing the script after this Skill has been audited. The curl -sSf options suppress normal progress output and do not add integrity verification.

This installation behavior supports the declared need to install a separately distributed MCP server, but direct download-to-shell execution exceeds the minimum privilege and trust required for installation. A staged, pinned, and cryptographically verified installer would provide the same functionality with materially less supply-chain risk.

Attack Path

1. The X-VPN MCP tools are unavailable, or the user requests installation guidance.
2. The Skill recommends the documented shell command.
3. The user runs the command in a local shell.
4. curl retrieves the current response from the external installer endpoint.
5. Shell process substitution passes the response directly to sh without integrity validation or prior inspection.
6. If the endpoint, hosting infrastructure, DNS/TLS trust chain, or release pipeline has been maliciously changed, attacker-controlled shell commands execute with the invoking user's privileges.

Impact Assessment

...[truncated 664 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the download-to-shell command with a staged installation procedure that saves the installer to a local file before execution.
2. Publish installers as immutable, versioned release artifacts rather than through a mutable opaque URL.
3. Publish a SHA-256 digest through an independently protected release channel and require verification before execution.
4. Prefer a cryptographic signature mechanism such as Sigstore, minisign, or GPG, and pin the expected signing identity or public key.
5. Permit the user to inspect the downloaded file and clearly disclose the files, services, daemon components, and configuration changes it will create.
6. Execute installation with the least privileges possible. Request elevation only for narrowly defined operations that genuinely require it.
7. Provide reproducible source or include an auditable installer in the reviewed distribution.
8. Use a pattern similar to:

   sh

   curl -fSLo xvpn-install.sh "https://trusted.example/releases/xvpn-install-vX.Y.Z.sh"
   printf '%s  %s\n' "<PINNED_SHA256>" "xvpn-install.sh" | sha256sum -c -
   sh xvpn-install.sh
   

   The version and digest must be genuine, immutable release values rather than placeholders when published.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to suggest a shell one-liner that downloads and immediately executes a remote script via curl and process substitution. This is dangerous because it provides no integrity verification, pinning, or user safety warning, so a compromised CDN, MITM in a weak trust environment, or malicious script update could lead to arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example hint says users should "search with English names," which imposes a language constraint in natural-language guidance. This is a locale/language policy issue because the file does not present it as an optional preference or provide an alternative for users who use other languages.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.