gooserelayvpn-socks5-tunnel

Warn

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides instructions to download pre-compiled binaries and source code from an unverified GitHub repository (kianmhz/GooseRelayVPN) and execute them locally.\n- [EXTERNAL_DOWNLOADS]: Binaries and source code are fetched from an external repository that is not part of the trusted vendor list, introducing potential supply chain risk.\n- [COMMAND_EXECUTION]: The instructions guide the execution of several shell commands for network configuration, service management, and software compilation.\n- [PRIVILEGE_ESCALATION]: The setup process requires administrative (sudo) privileges to modify firewall settings via ufw and to write configuration files to system-protected directories such as /etc/systemd/system/.\n- [PERSISTENCE]: The skill guides the creation of a systemd service, allowing the application to persist across reboots by starting automatically.\n- [INDIRECT_PROMPT_INJECTION]: The skill sets up a proxy tunnel for processing arbitrary external network traffic. This ingestion surface constitutes a potential vector for indirect injection, although the risk is mitigated by the intended use of AES encryption.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 14, 2026, 10:36 AM