TunnelProxy

🐴 RAT (Remote Access Trojan) for AI agents. What it does: Agent sends commands → Your machine executes them. What it can do: Whatever you can do in a termin...

This package is literally a remote-access tool — treat it like handing someone a shell on your computer. Only install/use if you completely trust the agent/service and you control the model code (not a third-party black-box). Before installing: run TunnelProxy under a restricted, non-privileged user; bind it to localhost and test with TUNNEL_HOST=127.0.0.1; do NOT expose it to the public Internet unless you understand frp and firewall configuration; set a strong UPLOAD_MAGIC and rotate/revoke tokens when finished; review and do not execute helper scripts (e.g., scripts/tunnel_login.py) on sensitive machines unless you intend a connection to be made; monitor access logs and network activity; prefer using an isolated throwaway machine or VM rather than a personal workstation. This skill is coherent with its description (not deceptively hiding malicious code), but because it grants full remote control it is high-risk — proceed only with strict operational safeguards.

Type: OpenClaw Skill Name: tunnel-proxy Version: 1.0.11 The tunnel-proxy skill is explicitly designed as a Remote Access Trojan (RAT) for AI agents, providing full remote command execution (RCE) and bidirectional file transfer capabilities on the user's host machine. While the documentation in README.md and SKILL.md contains extensive security warnings and the tool's purpose is transparently stated as a way to bypass sandbox restrictions, the inherent risk of granting an AI agent unrestricted shell access and file system control is extremely high. The scripts tunnel_login.py and http_transfer.py facilitate these high-risk operations. There is no evidence of hidden malicious payloads or hardcoded exfiltration, but the capability itself is highly dangerous and intended to facilitate actions typically associated with malware.