vps-proxy-tunnel

The skill is coherent with its stated purpose: building a VPS-backed proxy tunnel. It is not malware, and its network/data flows mostly go to official endpoints or a user-controlled VPS. The main risks are operational: disabled SSH host-key verification, direct reading of local credential files, remote file transfer through the VPS, exposed proxy listeners, and unpinned pip installation. Overall this is better classified as a legitimate but high-risk infrastructure skill, not a deceptive credential-harvesting one.

This is primarily an operational proxy/SSH tunneling bootstrapper. It does not show classic malware behaviors (no reverse shell, no explicit data theft), but it has significant security concerns: it performs a runtime, unpinned and unverified 'pip3 install -q proxy.py' on the VPS and immediately executes it, and it disables SSH host key checking while connecting as root. Treat it as a supply-chain and MITM-prone launcher; mitigate by pinning to a specific trusted package/version, verifying integrity, enabling SSH host key verification, restricting remote privileges, and improving logging/auditability.