The Agent Skills Directory

[DATA_EXFILTRATION]: The skill code extracts sensitive user and network metadata, including the real exit IP of a VPN server by routing requests through unauthenticated local SOCKS5 proxies. It also probes the Clash REST API to retrieve destination IPs for all active network connections.
[EXTERNAL_DOWNLOADS]: The documentation provides links to clone a repository and download a pre-built APK file from an untrusted GitHub account ('loop-uh'). Running pre-compiled binaries from unknown sources poses a significant security risk.
[COMMAND_EXECUTION]: The build instructions include shell commands to automate the compilation and installation of the application via ADB (adb install), which facilitates the deployment of the potentially invasive tool.
[DYNAMIC_EXECUTION]: The skill uses manual network socket manipulation and packet assembly (SOCKS5 handshakes, HTTP CONNECT probes) to interact with local services and external IP resolution APIs.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from local port scans and REST API responses (e.g., Clash API connection logs). There are no boundary markers or sanitization logic to prevent malicious data from influencing the agent's context or output.
[PRIVILEGE_ESCALATION]: The application requires and utilizes the QUERY_ALL_PACKAGES permission, allowing it to bypass standard Android package visibility restrictions to enumerate all installed VPN and security applications on the device.

yourvpndead-vpn-detection