Caveat verdict
proxy-expert
Reads local files AND makes external network calls
Skill sets up a VLESS+Reality VPN proxy on the user's own VPS for circumventing censorship; all SSH operations target the user's own server (credentials read from a local file), and the purpose of bypassing GFW is clearly stated and user-directed.
Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
What it does
These are capability combinations: each listed behavior occurs in the skill, but Caveat detects co-occurrence — it does not verify that one flows into another. Read the code to confirm a live chain.
Reads local files AND makes external network calls — the capabilities for data exfiltration co-occur (data-flow not verified)
LLM02 · LLM06 · ASI03
Accesses agent memory/notes AND makes external network calls — may leak personal data
LLM02 · LLM07 · ASI03 · ASI06
Accesses system credential store AND makes external network calls
LLM02 · ASI03
Reads files, encodes data, AND makes external network calls — the obfuscated-exfiltration pattern (data-flow not verified)
LLM02 · ASI03
Accesses credentials AND makes external network calls — potential credential theft
LLM02 · ASI03
Accesses credentials AND encodes data — may obfuscate stolen credentials
LLM02 · ASI03 · ASI04
Accesses credentials AND writes files — may persist stolen credentials locally
LLM02 · LLM06 · ASI03
Accesses agent memory AND writes files — may modify agent behavior persistently
LLM01 · LLM06 · ASI01 · ASI06
Accesses agent memory AND makes external network calls — may leak conversation history
LLM02 · LLM07 · ASI06
Both reads and writes files — verify scope is limited to intended directories
LLM06 · ASI02
Permission integrity
network_out
file_read+write
credential_access
package_install
agent_memory
Findings (7)
Possible hardcoded credential
SKILL.md · code · password = "{SSH_PASSWORD}
References SSH/GPG private keys
SKILL.md · code · SSH_KEY
Accesses .ssh directory
SKILL.md · code · .ssh/
apt-get install — installs system packages
SKILL.md · code · apt-get install
HTTP request to bare IP address — common in malicious payloads
SKILL.md · code · http://127.0.0.1
References sudo — requests elevated privileges
references/troubleshooting.md · code · sudo
Sets world-executable permissions
SKILL.md · code · chmod 700
Permissions & capabilities
No declared permissions — minimal attack surface.
agent_memorycredential_storepackage_installfile_readfile_writedata_encodingnetwork_outcredential_accessnetwork_in Thanks — recorded.