安全决策报告
tunnel-proxy
This skill is explicitly documented as a RAT (Remote Access Trojan) framework that grants cloud-hosted AI agents unrestricted shell access and full filesystem control on the user's local machine, enabling arbitrary command execution, bidirectional file transfer, and network tunneling through the user's IP — all of which is fully declared but represents extreme danger if the agent is compromised or untrusted.
最直接的威胁证据
严重 代码执行
Unrestricted PTY shell access granted to agent The skill enables the AI agent to obtain a one-time PTY session and send arbitrary bytes directly to a raw TCP socket. tunnel_login.py opens a socket, connects to the PTY port, and sends b'ls -la\n' — this pattern executes ANY command the agent submits with no validation, no logging visible to the agent, and no user confirmation. The 10-second PTY timeout is trivial to bypass by repeatedly requesting new sessions.
scripts/tunnel_login.py:12 为什么得出这个结论
2/4 个维度触发 通过
声明与实际能力
声明资源与推断能力基本一致。
阻止
隐藏执行与外联
提取到 3 个高危 IOC 或外联信号。
阻止
攻击链与高危发现
报告包含 6 步攻击链，另有 3 项高危或严重发现。
复核
依赖与供应链卫生
发现 1 项需要关注的依赖或供应链线索。
攻击链
01
User installs TunnelProxy skill and starts the local TunnelProxy service
初始入口 · README.md:28
02
Agent connects to user's TunnelProxy via HTTP API using TUNNEL_HOST/TUNNEL_PORT
初始入口 · SKILL.md:105
03
Agent requests PTY session and receives a one-time TCP port
权限提升 · SKILL.md:115
04
Agent connects to PTY port and sends arbitrary shell commands (e.g., 'curl ... | sh', 'rm -rf ~')
权限提升 · scripts/tunnel_login.py:12
05
Agent reads sensitive files via HTTP download (e.g., ~/.ssh/id_rsa, ~/.aws/credentials)
最终危害 · scripts/http_transfer.py:41
06
Agent exfiltrates data or uses user's IP for illegal activity via /proxy endpoint
最终危害 · SKILL.md:87
风险分是怎么被拉高的
RAT designation in metadata +20
SKILL.md metadata frontmatter explicitly calls this '🐴 RAT (Remote Access Trojan)'
Unrestricted shell access via PTY +20
Agent can obtain a one-time PTY session and execute any shell command with no filtering, whitelisting, or confirmation (tunnel_login.py line 12-13: raw socket.send of arbitrary bytes)
Arbitrary file read/write/delete via tunnel +15
http_transfer.py downloads and uploads any file path on the user's filesystem with no path restrictions (line 41-42, 54)
Network tunneling through user's IP +10
Agent can route external requests through the user's network connection, enabling IP spoofing for illegal activities
最关键的证据
严重 代码执行
Unrestricted PTY shell access granted to agent
The skill enables the AI agent to obtain a one-time PTY session and send arbitrary bytes directly to a raw TCP socket. tunnel_login.py opens a socket, connects to the PTY port, and sends b'ls -la\n' — this pattern executes ANY command the agent submits with no validation, no logging visible to the agent, and no user confirmation. The 10-second PTY timeout is trivial to bypass by repeatedly requesting new sessions.
scripts/tunnel_login.py:12 Implement command whitelisting, rate limiting on /api/session, and require user approval for interactive sessions.
高危 敏感访问
No path restrictions on file transfer operations
http_transfer.py can download or upload any path on the user's filesystem (e.g., ~/.ssh/id_rsa, ~/.aws/credentials, /etc/passwd) without any path sandboxing. The agent can traverse directories arbitrarily and overwrite any file.
scripts/http_transfer.py:41 Implement path allowlisting on the TunnelProxy server side to restrict accessible directories.
高危 数据外泄
No command output filtering or logging controls
SKILL.md describes command execution and file browsing but provides no mechanism for the user to audit what the agent did. The PTY channel returns raw output with no centralized logging. An agent could silently exfiltrate sensitive files and delete evidence.
scripts/tunnel_login.py:13 Add mandatory audit logging on the TunnelProxy server side for all commands and file operations.
中危 文档欺骗
SKILL.md metadata frontmatter declares RAT intent explicitly
The metadata YAML block in SKILL.md contains 'description: > 🐴 RAT (Remote Access Trojan) for AI agents. What it does: Agent sends commands → Your machine executes them.' This is an honest declaration of intent but is buried in YAML frontmatter rather than prominent prose.
SKILL.md:2 Prominently surface the RAT designation and risk summary in the skill's visual card and introduction, not just in YAML metadata.
中危 权限提升
No process-level isolation declared or enforced
README.md mentions using 'sudo or rbash' as an optional safeguard, but the skill does not implement any technical controls to enforce restricted execution. Any command including privilege-escalation attempts runs as the TunnelProxy process user.
README.md:60 Make process isolation a required configuration step, not an optional footnote.
低危 供应链
Dependency versions not pinned
requirements.txt declares 'requests' without a version constraint, allowing any version to be installed including potentially vulnerable ones.
requirements.txt:1 Pin to a specific version (e.g., requests>=2.31.0) with known security patches.
声明能力 vs 实际能力
命令执行 通过
声明 WRITE
→ 推断 WRITE
PTY session via /api/session → raw socket (tunnel_login.py:12) 文件系统 通过
声明 WRITE
→ 推断 WRITE
download()/upload() in http_transfer.py:41-58 网络访问 通过
声明 READ
→ 推断 READ
urllib.request for all HTTP API calls 可疑产物与外联
严重 危险命令
rm -rf / README.md:28
严重 危险命令
curl ... | sh README.md:28
严重 危险命令
rm -rf ~ references/README_for_agent.md:46
中危 外部 URL
http://127.0.0.1:8080 README.md:102
中危 外部 URL
https://hex.pm/packages/tunnel_proxy README.md:175
中危 外部 URL
https://blocked-site.com SKILL.md:87
中危 外部 URL
https://httpbin.org/ip SKILL.md:198
中危 外部 URL
http://internal-company-server/api/data SKILL.md:292
中危 外部 URL
http://127.0.0.1:8080/path/to/large.bin references/TIPS.md:120
中危 外部 URL
https://slow-site.com references/TIPS.md:151
中危 外部 URL
http://127.0.0.1:8080/upload references/TIPS.md:162
中危 外部 URL
https://en.wikipedia.org/wiki/Pseudoterminal references/TIPS.md:262
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| requests | * | pip | 否 | Version not pinned — could resolve to a vulnerable version |
文件构成
11 个文件 · 1204 行
Markdown 7 个文件 · 1085 行Python 2 个文件 · 113 行JSON 1 个文件 · 5 行Text 1 个文件 · 1 行
需关注文件 · 8
SKILL.md SKILL.md metadata frontmatter declares RAT intent explicitly · https://blocked-site.com · https://httpbin.org/ip · http://internal-company-server/api/data
references/TIPS.md http://127.0.0.1:8080/path/to/large.bin · https://slow-site.com · http://127.0.0.1:8080/upload · https://en.wikipedia.org/wiki/Pseudoterminal
README.md No process-level isolation declared or enforced · rm -rf / · curl ... | sh · http://127.0.0.1:8080 · https://hex.pm/packages/tunnel_proxy
references/README_for_agent.md rm -rf ~
scripts/http_transfer.py No path restrictions on file transfer operations
skill-card.md https://clawhub.ai/user/turinfohlen · https://clawhub.ai/turinfohlen/tunnel-proxy
scripts/tunnel_login.py Unrestricted PTY shell access granted to agent · No command output filtering or logging controls
requirements.txt Dependency versions not pinned
其他文件 · README_for_user.md · protocol.md · _meta.json
安全亮点
All capabilities are explicitly declared in SKILL.md with prominent security warnings — there is no hidden functionality
README.md and references/README_for_agent.md contain detailed ethical guidelines for agent behavior
README.md explicitly warns against use with untrusted third-party agents
UPLOAD_MAGIC token provides a minimal authentication layer for file uploads
No base64 encoding, obfuscation, or anti-analysis techniques detected
No references to external C2 infrastructure, credential harvesting loops, or reverse shell callbacks
The skill requires user installation and local TunnelProxy service startup — it cannot operate without deliberate user action