Network Communications Security Audit Report

Project: scorpiox/clang Audit Date: 2026-04-28 Auditor: Security Audit Agent Scope: All network communications, endpoints, protocols, and telemetry in the codebase (493 .c/.h files, 224 non-vendor)

---

1. Network Activity Summary

The scorpiox codebase is a network-intensive application consisting of an AI coding agent platform with multiple LLM provider integrations, infrastructure tooling, and supporting services. Network activity falls into these categories:

---

2. Endpoint Inventory

2.1 Hardcoded Production Endpoints

2.2 Hardcoded Internal/Private IPs

2.3 Hardcoded Credentials in Embedded Config

---

3. Protocol Analysis

3.1 HTTP/HTTPS (libcurl + WASM fetch)

Implementation: sx_http.c (native via libcurl), sx_http_wasm.c (browser fetch API)

• Native path: Uses libcurl with standard TLS. Default timeout: 600s.
• WASM path: Uses synchronous XHR or async fetch via Emscripten. Proxy through /api/platform/websites/wasm_scorpiox_proxy.
• Streaming: SSE (Server-Sent Events) for streaming LLM responses.
• Headers: Standard Content-Type: application/json, provider-specific auth headers.
• Cancel support: Progress callback can abort transfers.

3.2 Raw TCP Socket

Implementation: scorpiox-claudecode-fetchtoken.c

• Purpose: Fetch OAuth tokens from a raw TCP server.
• Protocol: Fire-and-forget: connect → server sends JSON → server closes connection.
• Default endpoint: 20.53.240.54:9800 (hardcoded in WASM config).
• Security: NO TLS — tokens transmitted in plaintext over TCP.
• Timeout: 10 seconds (SO_RCVTIMEO/SO_SNDTIMEO).

3.3 FRP Reverse Proxy

Implementation: sx_frp.c (2118 lines)

• Protocol: FRP wire format: [1 byte type][8 byte int64 BE length][JSON payload]
• Auth: MD5(token + timestamp) → hex string. Weak — MD5 is cryptographically broken.
• Encryption: AES-128-CFB on control stream. Key derived via PBKDF2-SHA1 with only 64 iterations and salt "frp". Weak — low iteration count.
• TLS: Optional TLS layer for frps-secure using mbedTLS. Certificate verification DISABLED (MBEDTLS_SSL_VERIFY_NONE).
• Yamux multiplexing: Multiple streams over single TCP connection.
• Heartbeat: 30-second ping/pong intervals.

3.4 SMTP (Email)

Implementation: scorpiox-email.c (libcurl), sxmail_queue.c (native SMTP client)

• Protocols: SMTP with STARTTLS (port 587), implicit TLS (port 465), plaintext (port 25).
• Auth: AUTH PLAIN and AUTH LOGIN supported.
• TLS in relay: mbedTLS with VERIFY_NONE — no certificate validation.
• MX lookup: Direct DNS MX resolution via getaddrinfo().

3.5 DNS Server

Implementation: scorpiox-dns.c

• Listens: UDP + TCP on port 53.
• Upstream: Configurable, default 8.8.8.8 and 1.1.1.1.
• Features: Split-horizon, caching, zone management.
• Scope: Infrastructure service, not agent core functionality.

3.6 HTTP Server

Implementation: scorpiox-server.c (3174 lines)

• Listens: Default port 8080 (configurable).
• Auth: JWT HMAC-SHA256 validation (cookie-based).
• URL handling: Git clone with PAT injection into URLs.

3.7 WebSocket Bridge

Implementation: bridge/ws2tcp.c

• Listens: Default port 6080.
• Protocol: WebSocket (RFC 6455) to raw TCP bridge.
• Purpose: noVNC frontend connectivity.
• Uses: epoll for I/O multiplexing.

3.8 HTTP Relay

Implementation: sx_http_relay.c

• Protocol: Custom binary protocol over TCP: SXH1 magic header, big-endian framing.
• Default: 127.0.0.1:9801 (or relay.scorpiox.net:9801).
• Purpose: Offload HTTP/HTTPS to a relay server (for environments without libcurl/TLS).
• Activation: Opt-in via HTTP_RELAY=1 config.

3.9 Unix Domain Sockets

Implementation: sxmux_session.c

• Purpose: Local IPC for terminal multiplexer sessions.
• Scope: AF_UNIX, SOCK_STREAM — no network exposure.
• Risk: Low — local only.

---

4. Telemetry Assessment

Classification: MODERATE — Opt-in with sensible defaults

4.1 Usage Tracking (scorpiox-usage.c)

4.2 Session Event Telemetry (scorpiox-emit-session.c)

4.3 Cache Keepalive (sx_cache_keepalive.c)

• Sends periodic heartbeat pings (every 60s) to keep LLM API cache warm.
• User-configurable interval and max attempts.
• This generates billable API traffic to provider endpoints.

4.4 Software Update Checks

• scorpiox-wsl.c: Auto-downloads updates from dist.scorpiox.net/executables/.
• scorpiox-whatsapp.c: Auto-downloads WhatsApp bridge binary.
• scorpiox-tmux.c: Resolves binaries via distribution index.

---

5. TLS/SSL Security Analysis

5.1 Certificate Verification

5.2 Specific TLS Findings

sx_frp.c:1105 — mbedtls_ssl_conf_authmode(conf, MBEDTLS_SSL_VERIFY_NONE)

- FRP client skips all certificate verification.

- Vulnerable to MITM attacks on the control channel.

sxmail_queue.c:532 — mbedtls_ssl_conf_authmode(&tls->conf, MBEDTLS_SSL_VERIFY_NONE)

- SMTP relay TLS skips cert verification. Comment says "relay is trusted".

- Vulnerable to MITM on outbound email relay connections.

sxmail_tls.c:185 — mbedtls_ssl_conf_authmode(&c->conf, MBEDTLS_SSL_VERIFY_NONE)

- SMTP server TLS connection skips verification.

Token fetch over raw TCP — scorpiox-claudecode-fetchtoken.c

- OAuth tokens transmitted over unencrypted TCP to 20.53.240.54:9800.

- No integrity or confidentiality protection.

5.3 TLS Version

• mbedTLS defaults used (MBEDTLS_SSL_PRESET_DEFAULT) — supports TLS 1.2+.
• No explicit minimum version enforcement found.
• FRP uses custom 0x17 marker byte before TLS handshake (FRP-specific protocol).

---

6. Data Flow Diagrams

6.1 AI Provider Request Flow

User Input
    │
    ▼
┌──────────┐   JSON/HTTPS   ┌────────────────────────────┐
│  sx.c    │ ──────────────► │ api.anthropic.com          │
│ (agent)  │ ◄────────────── │ api.openai.com             │
└──────────┘   SSE stream    │ generativelanguage.google  │
    │                        │ chatgpt.com                │
    │                        │ api.z.ai                   │
    ▼                        └────────────────────────────┘
Display Response

6.2 Token Acquisition Flow

                        ┌──────────────────────────────────────┐
                        │  Token Source (configurable)          │
                        │                                      │
  ┌─────────┐   TCP    │  ① Raw TCP  → 20.53.240.54:9800     │
  │fetchtoken│ ◄───────│  ② HTTP     → token.scorpiox.net    │
  │   exe    │   SSH    │  ③ SSH      → 192.168.1.6:22223    │
  │          │ ◄───────│  ④ Local    → ~/.claude/.credentials│
  └─────────┘   File   │  ⑤ Config   → scorpiox-env.txt     │
       │                └──────────────────────────────────────┘
       ▼
  OAuth Token → Provider API

6.3 Telemetry Flow

  ┌──────────┐                    ┌─────────────────────┐
  │  sx.c    │  fire-and-forget   │ code.scorpiox.net   │
  │ (agent)  │ ──────────────────►│   /usage-send       │
  │          │  POST JSON/HTTPS   │   /sessions-send    │
  └──────────┘                    └─────────────────────┘
       │                                    │
       │ Collects:                          │ Receives:
       │  • session_id                      │  • token usage stats
       │  • hostname, username              │  • conversation content
       │  • os, arch                        │  • machine fingerprint
       │  • provider, model                 │
       │  • token counts                    │
       │  • message content (sessions)      │

6.4 FRP Reverse Proxy Flow

  ┌───────────────┐   TCP+TLS(no verify)   ┌──────────┐
  │ sx_frp.c      │ ◄─────────────────────► │ frps     │
  │ (frpc client) │   yamux multiplexing    │ server   │
  └───────┬───────┘   AES-128-CFB crypto    └────┬─────┘
          │                                       │
          │ local:127.0.0.1:port                  │ remote:port
          ▼                                       ▼
    Local Service                          Remote Access

---

7. DNS Resolution Analysis

Note: A DNS_AUDIT_LOG config option exists (default: disabled) for logging DNS queries to /var/log/scorpiox-dns.

---

8. Data Exfiltration Pattern Analysis

8.1 Potential Patterns Found

8.2 No Covert Exfiltration Found

No patterns of covert data exfiltration were identified. All network transmissions serve documented purposes and are either user-initiated or controlled by explicit configuration flags.

---

9. Risk Assessment

9.1 Critical Findings

9.2 High Findings

9.3 Medium Findings

9.4 Low Findings

---

10. Recommendations

Rotate all embedded credentials immediately — API keys, SSH passwords in sx_config_embedded.c are compromised by being in source code.

Enable TLS certificate verification on all mbedTLS connections — replace MBEDTLS_SSL_VERIFY_NONE with MBEDTLS_SSL_VERIFY_REQUIRED and load CA certificates.

Upgrade token fetch to HTTPS — replace raw TCP token acquisition with TLS-secured transport.

Upgrade token.scorpiox.net and router URL to HTTPS — all authentication-related traffic must be encrypted.

Replace MD5 in FRP auth with SHA-256 or better.

Increase PBKDF2 iterations in FRP from 64 to at least 600,000.

Add binary signature verification for auto-update downloads.

Remove private network IPs from the WASM embedded config.

Add integrity checking (checksums/signatures) for downloaded container images and firmware.

Document all network endpoints in user-facing documentation so users can configure firewalls appropriately.

---

11. Appendix: Complete File-to-Network-Function Mapping

Files with Direct Socket Operations

Files Using libcurl (via sx_http.c)

---

Report generated by Security Audit Agent — 2026-04-28