skills/vichhka-git/opentor/open-tor/Gen Agent Trust Hub

open-tor

Fail

Audited by Gen Agent Trust Hub on May 8, 2026

Risk Level: CRITICALCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/setup.py script uses subprocess.run to install Python dependencies from requirements.txt and check for the presence of the Tor binary on the system.
  • [COMMAND_EXECUTION]: The scripts/torcore.py module utilizes subprocess.Popen within the TorPool class to manage and spawn multiple local Tor daemon processes for increased scraping throughput.
  • [COMMAND_EXECUTION]: The SKILL.md file instructs the agent to request sudo permissions from the user for administrative tasks such as installing the Tor package or starting the system service.
  • [EXTERNAL_DOWNLOADS]: The skill is primarily designed to fetch and process content from external sources across the Tor network, utilizing a transport layer in scripts/torcore.py to route traffic through SOCKS5 proxies.
  • [EXTERNAL_DOWNLOADS]: Hardcoded .onion addresses for ransomware group leak sites (ALPHV and LockBit) are included in scripts/engines.py as verified research seeds for threat intelligence monitoring.
  • [DATA_EXFILTRATION]: The scripts/osint.py module implements regex-based entity extraction to identify and collect sensitive artifacts (emails, PGP keys, Bitcoin/Monero/Ethereum addresses, and phone numbers) from scraped web content.
  • [SAFE]: The skill implements a mandatory content safety filter in scripts/torcore.py that scans URLs, titles, and page text for blacklisted tokens associated with illegal content, blocking access at the transport layer.
  • [SAFE]: The SKILL.md establishes professional OSINT reporting standards, mandating the use of verification labels (e.g., '✓ Observed', '⚡ Inferred') to ensure transparency in the agent's findings.
  • [SAFE]: The scripts/setup.py script facilitates secure environment configuration by prompting the user for necessary API keys (OpenAI, Anthropic, Gemini) and storing them in a local .env file rather than hardcoding credentials.
Recommendations
  • Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
May 8, 2026, 04:10 PM
Security Audit — agent-trust-hub — open-tor