cliproxy-deploy
Warn
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Downloads source code from an unverified GitHub repository (
github.com/router-for-me/CLIProxyAPI) and executes it using thego runcommand. - Evidence:
git clone https://github.com/router-for-me/CLIProxyAPI.git /root/CLIProxyAPI && go run ./cmd/serverinSKILL.md. - [EXTERNAL_DOWNLOADS]: Fetches executable content and toolchains from external sources during the deployment process.
- Evidence: Clones the repository from
github.com/router-for-me/CLIProxyAPIand triggers automatic Go toolchain downloads viaGOTOOLCHAINduring code execution. - [COMMAND_EXECUTION]: Performs several sensitive system-level operations on a remote host via SSH.
- Evidence: Modifies firewall rules using
ufw allow <PORT>/tcp. - Evidence: Installs system packages using
apt-get install -y golang-go git. - Evidence: Terminates specific processes using
pkill -f 'cmd/server -config'. - Evidence: Persistently modifies user shell profiles (
~/.zshrcor~/.bashrc) to store environment variables. - [CREDENTIALS_UNSAFE]: Handles and transfers sensitive authentication materials between local and remote environments.
- Evidence: Syncs OAuth credential files (
~/.cli-proxy-api/*.json) from the local machine to a remote VPS viascp. - Evidence: Manages SSH private keys used for remote server access.
- Evidence: Stores generated API keys in plaintext within
config.yamland shell environment variables. - [DATA_EXFILTRATION]: The core functionality involves moving local account credentials (OAuth tokens for third-party services) to an external server to be exposed as an API endpoint.
- [PROMPT_INJECTION]: Vulnerable to indirect prompt injection (Category 8) due to the lack of sanitization when processing data from the deployed service.
- Ingestion points: Reading output from the deployed API via
curl ... /v1/models | head -c 400inSKILL.md. - Boundary markers: Absent.
- Capability inventory: The skill has extensive system capabilities including
Bashtool access, SSH command execution, package installation, and file system writes. - Sanitization: No evidence of validation or escaping for the ingested content.
Audit Metadata