vpn
Warn
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONCREDENTIALS_UNSAFEPERSISTENCEEXTERNAL_DOWNLOADS
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill performs operations that require administrative access to alter system-wide network configurations and services.
- It modifies system files such as
/etc/sysctl.confto enable IP forwarding. - It performs software installation using
aptand manages system services usingsystemctlto enable the VPN on boot. - [COMMAND_EXECUTION]: The skill utilizes shell scripts and the Python
subprocessmodule to execute low-level networking and encryption utilities. - It invokes system tools including
wg,wg-quick,openvpn,ip, andiptablesto manage tunnels and routing. - [CREDENTIALS_UNSAFE]: The Python client implementation handles sensitive cryptographic material insecurely by writing it to a predictable, shared location.
- It writes WireGuard and OpenVPN configuration files containing private keys to
/tmp/wg0.confand/tmp/client.ovpn. On many systems, the/tmpdirectory is world-readable, potentially exposing these credentials to other local users. - [PERSISTENCE]: The skill implements a persistence mechanism to ensure the VPN tunnel remains active across system restarts.
- It uses
systemctl enableto register the VPN as a persistent system service. - [EXTERNAL_DOWNLOADS]: The Python implementation relies on the
wgconfiglibrary, which is an external dependency not included in the standard Python library.
Audit Metadata