Skill Trust Decision
tunnel-proxy
This skill is explicitly documented as a RAT (Remote Access Trojan) framework that grants cloud-hosted AI agents unrestricted shell access and full filesystem control on the user's local machine, enabling arbitrary command execution, bidirectional file transfer, and network tunneling through the user's IP — all of which is fully declared but represents extreme danger if the agent is compromised or untrusted.
Most direct threat evidence
Critical RCE
Unrestricted PTY shell access granted to agent The skill enables the AI agent to obtain a one-time PTY session and send arbitrary bytes directly to a raw TCP socket. tunnel_login.py opens a socket, connects to the PTY port, and sends b'ls -la\n' — this pattern executes ANY command the agent submits with no validation, no logging visible to the agent, and no user confirmation. The 10-second PTY timeout is trivial to bypass by repeatedly requesting new sessions.
scripts/tunnel_login.py:12 Why this conclusion was reached
2/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Block
Hidden execution and egress
3 high-risk artifacts or egress signals were extracted.
Block
Attack chain and severe findings
The report includes 6 attack-chain steps and 3 severe findings.
Review
Dependencies and supply chain hygiene
1 dependency or supply-chain issues need attention.
Attack Chain
01
User installs TunnelProxy skill and starts the local TunnelProxy service
Entry · README.md:28
02
Agent connects to user's TunnelProxy via HTTP API using TUNNEL_HOST/TUNNEL_PORT
Entry · SKILL.md:105
03
Agent requests PTY session and receives a one-time TCP port
Escalation · SKILL.md:115
04
Agent connects to PTY port and sends arbitrary shell commands (e.g., 'curl ... | sh', 'rm -rf ~')
Escalation · scripts/tunnel_login.py:12
05
Agent reads sensitive files via HTTP download (e.g., ~/.ssh/id_rsa, ~/.aws/credentials)
Impact · scripts/http_transfer.py:41
06
Agent exfiltrates data or uses user's IP for illegal activity via /proxy endpoint
Impact · SKILL.md:87
What drove the risk score up
RAT designation in metadata +20
SKILL.md metadata frontmatter explicitly calls this '🐴 RAT (Remote Access Trojan)'
Unrestricted shell access via PTY +20
Agent can obtain a one-time PTY session and execute any shell command with no filtering, whitelisting, or confirmation (tunnel_login.py line 12-13: raw socket.send of arbitrary bytes)
Arbitrary file read/write/delete via tunnel +15
http_transfer.py downloads and uploads any file path on the user's filesystem with no path restrictions (line 41-42, 54)
Network tunneling through user's IP +10
Agent can route external requests through the user's network connection, enabling IP spoofing for illegal activities
Most important evidence
Critical RCE
Unrestricted PTY shell access granted to agent
The skill enables the AI agent to obtain a one-time PTY session and send arbitrary bytes directly to a raw TCP socket. tunnel_login.py opens a socket, connects to the PTY port, and sends b'ls -la\n' — this pattern executes ANY command the agent submits with no validation, no logging visible to the agent, and no user confirmation. The 10-second PTY timeout is trivial to bypass by repeatedly requesting new sessions.
scripts/tunnel_login.py:12 Implement command whitelisting, rate limiting on /api/session, and require user approval for interactive sessions.
High Sensitive Access
No path restrictions on file transfer operations
http_transfer.py can download or upload any path on the user's filesystem (e.g., ~/.ssh/id_rsa, ~/.aws/credentials, /etc/passwd) without any path sandboxing. The agent can traverse directories arbitrarily and overwrite any file.
scripts/http_transfer.py:41 Implement path allowlisting on the TunnelProxy server side to restrict accessible directories.
High Data Exfil
No command output filtering or logging controls
SKILL.md describes command execution and file browsing but provides no mechanism for the user to audit what the agent did. The PTY channel returns raw output with no centralized logging. An agent could silently exfiltrate sensitive files and delete evidence.
scripts/tunnel_login.py:13 Add mandatory audit logging on the TunnelProxy server side for all commands and file operations.
Medium Doc Mismatch
SKILL.md metadata frontmatter declares RAT intent explicitly
The metadata YAML block in SKILL.md contains 'description: > 🐴 RAT (Remote Access Trojan) for AI agents. What it does: Agent sends commands → Your machine executes them.' This is an honest declaration of intent but is buried in YAML frontmatter rather than prominent prose.
SKILL.md:2 Prominently surface the RAT designation and risk summary in the skill's visual card and introduction, not just in YAML metadata.
Medium Priv Escalation
No process-level isolation declared or enforced
README.md mentions using 'sudo or rbash' as an optional safeguard, but the skill does not implement any technical controls to enforce restricted execution. Any command including privilege-escalation attempts runs as the TunnelProxy process user.
README.md:60 Make process isolation a required configuration step, not an optional footnote.
Low Supply Chain
Dependency versions not pinned
requirements.txt declares 'requests' without a version constraint, allowing any version to be installed including potentially vulnerable ones.
requirements.txt:1 Pin to a specific version (e.g., requests>=2.31.0) with known security patches.
Declared capability vs actual capability
Shell Pass
Declared WRITE
→ Inferred WRITE
PTY session via /api/session → raw socket (tunnel_login.py:12) Filesystem Pass
Declared WRITE
→ Inferred WRITE
download()/upload() in http_transfer.py:41-58 Network Pass
Declared READ
→ Inferred READ
urllib.request for all HTTP API calls Suspicious artifacts and egress
Critical Dangerous Command
rm -rf / README.md:28
Critical Dangerous Command
curl ... | sh README.md:28
Critical Dangerous Command
rm -rf ~ references/README_for_agent.md:46
Medium External URL
http://127.0.0.1:8080 README.md:102
Medium External URL
https://hex.pm/packages/tunnel_proxy README.md:175
Medium External URL
https://blocked-site.com SKILL.md:87
Medium External URL
https://httpbin.org/ip SKILL.md:198
Medium External URL
http://internal-company-server/api/data SKILL.md:292
Medium External URL
http://127.0.0.1:8080/path/to/large.bin references/TIPS.md:120
Medium External URL
https://slow-site.com references/TIPS.md:151
Medium External URL
http://127.0.0.1:8080/upload references/TIPS.md:162
Medium External URL
https://en.wikipedia.org/wiki/Pseudoterminal references/TIPS.md:262
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| requests | * | pip | No | Version not pinned — could resolve to a vulnerable version |
File composition
11 files · 1204 lines
Markdown 7 files · 1085 linesPython 2 files · 113 linesJSON 1 files · 5 linesText 1 files · 1 lines
Files of concern · 8
SKILL.md SKILL.md metadata frontmatter declares RAT intent explicitly · https://blocked-site.com · https://httpbin.org/ip · http://internal-company-server/api/data
references/TIPS.md http://127.0.0.1:8080/path/to/large.bin · https://slow-site.com · http://127.0.0.1:8080/upload · https://en.wikipedia.org/wiki/Pseudoterminal
README.md No process-level isolation declared or enforced · rm -rf / · curl ... | sh · http://127.0.0.1:8080 · https://hex.pm/packages/tunnel_proxy
references/README_for_agent.md rm -rf ~
scripts/http_transfer.py No path restrictions on file transfer operations
skill-card.md https://clawhub.ai/user/turinfohlen · https://clawhub.ai/turinfohlen/tunnel-proxy
scripts/tunnel_login.py Unrestricted PTY shell access granted to agent · No command output filtering or logging controls
requirements.txt Dependency versions not pinned
Other files · README_for_user.md · protocol.md · _meta.json
Security positives
All capabilities are explicitly declared in SKILL.md with prominent security warnings — there is no hidden functionality
README.md and references/README_for_agent.md contain detailed ethical guidelines for agent behavior
README.md explicitly warns against use with untrusted third-party agents
UPLOAD_MAGIC token provides a minimal authentication layer for file uploads
No base64 encoding, obfuscation, or anti-analysis techniques detected
No references to external C2 infrastructure, credential harvesting loops, or reverse shell callbacks
The skill requires user installation and local TunnelProxy service startup — it cannot operate without deliberate user action