Network Communications Audit Report

Codebase: scorpiox/clang Audit Date: 2026-04-28 Auditor: Security Audit Agent Scope: All network-related function calls, endpoints, protocols, and telemetry

---

1. Network Activity Summary

The scorpiox codebase is a highly network-active application suite. It contains:

• ~90+ source files (non-vendor) with network-related code
• Multiple AI provider integrations (Anthropic, OpenAI/Codex, Gemini, custom routers)
• Custom server infrastructure (HTTP server, DNS server, SMTP/IMAP server, fetchtoken server, FRP tunnel server)
• Telemetry subsystems (session tracking, usage reporting)
• Distribution/update system (auto-download binaries, container images, firmware)
• Peripheral network tools (web search, voice transcription, file transfer, WebSocket bridge)

Key Libraries Used

---

2. Endpoint Inventory

2.1 AI Provider API Endpoints

2.2 OAuth / Token Endpoints

2.3 Telemetry / Reporting Endpoints

2.4 Distribution / Update Endpoints

2.5 Web Search Endpoints

2.6 Voice / Whisper Endpoint

2.7 Server / Listening Services

2.8 Internal / Infrastructure

2.9 Hardcoded IP Addresses

---

3. Protocol Analysis

3.1 HTTP/HTTPS (via libcurl)

• Implementation: sx_http.c wraps libcurl for all native HTTP/HTTPS operations
• WASM alternative: sx_http_wasm.c uses browser fetch() API
• Relay mode: sx_http_relay.c provides a TCP-based relay for environments without libcurl/TLS
• Features: Streaming SSE support, header callbacks, progress/cancel, timeout control

3.2 Raw TCP (POSIX sockets)

• Token fetch: sx_tcp_fetch.c — multi-host failover, SXV1 protocol with AUTH, backward compat
• File transfer: scorpiox-beam.c — direct TCP with checksum verification
• Server: scorpiox-server.c — custom HTTP/1.1 server with fork-per-request
• DNS: scorpiox-dns.c — UDP + TCP DNS on port 53

3.3 FRP Tunneling

• Implementation: sx_frp.c — full FRP client protocol (yamux multiplexing over TCP)
• Crypto: AES-128-CFB on control stream (PBKDF2 key derivation, mbedTLS)
• Optional TLS: mbedTLS wrapping before yamux layer
• Purpose: Expose local services through NAT via remote frps server

3.4 WebSocket

• ws2tcp bridge: bridge/ws2tcp.c — WebSocket-to-TCP for noVNC
• CDP: scorpiox-fetch.c — WebSocket to Chrome DevTools Protocol for browser rendering

3.5 Raw Ethernet (Thunderbolt 4)

• Implementation: libtb4/tb4_transport.c — BPF-based raw Ethernet frames (macOS only)
• EtherType: 0x88B5 (custom)
• Features: Stream protocol with sliding window, ACK, keepalive, SYN handshake
• Purpose: High-speed local file/data transfer between Thunderbolt-connected machines

3.6 SMTP/IMAP

• Client: scorpiox-email.c — libcurl-based SMTP client (STARTTLS/SSL/plain)
• Server: scorpiox-server-email.c — SMTP MTA + IMAP server (mbedTLS for TLS)
• Queue: sxmail_queue.c — outbound delivery with MX resolution and retry

---

4. Telemetry Assessment

Rating: MODERATE — opt-in telemetry with fire-and-forget pattern

4.1 Session Event Telemetry (EMIT_SESSION_TRACKING)

• Gate: Requires EMIT_SESSION_TRACKING=1 in config (default: 0 in native, 1 in WASM embedded config)
• Endpoint: https://code.scorpiox.net/sessions-send
• Data sent: Session ID, message sequence, message type (user/assistant/tool_call/etc.), message text, provider name, model name
• Machine metadata: hostname, username, OS, arch, OS version, scorpiox version
• Mechanism: Fire-and-forget via system() call to scorpiox-emit-session binary (runs in background)
• Files: sx.c (report_emit_session_async), scorpiox-emit-session.c
• ⚠ RISK: When enabled, full message content (including user prompts and AI responses) is sent to the telemetry server. Message text is written to /tmp/sx_emit_*.txt temp files before sending.

4.2 Token Usage Telemetry (USAGE_TRACKING)

• Gate: Requires USAGE_TRACKING not equal to 0 (not explicitly disabled)
• Endpoint: https://code.scorpiox.net/usage-send
• Data sent: Session ID, provider, model, token counts (input/output/cache), machine metadata
• Mechanism: POST via libcurl/sx_http
• Files: scorpiox-usage.c

4.3 Cache Keepalive (NOT telemetry)

• Purpose: Prevents AI context cache from expiring by sending lightweight ping messages
• Mechanism: Timer thread sets a flag; main loop sends a normal API message through the standard provider
• Network impact: Additional API requests to the AI provider (e.g., Anthropic)
• NOT external telemetry — this is functional cache management
• Files: sx_cache_keepalive.c

4.4 Traffic Logging (Local)

• Purpose: Debug logging of API request/response bodies
• Storage: Local files under .scorpiox/traffics/ and .scorpiox/sessions/
• NOT network telemetry — all local disk

---

5. TLS/SSL Security Assessment

5.1 Certificate Validation Disabled (⚠ HIGH RISK)

Multiple files disable SSL peer and host verification:

Pattern observed: Most files attempt CA bundle loading first (CURLOPT_CAINFO), then fall back to disabling verification. This suggests a development/portability workaround that was never properly resolved.

5.2 Proper TLS Usage

• sx_http.c:153 — Sets CURLOPT_CAINFO if SX_CA_BUNDLE config is available
• scorpiox-pwsh.c:353 — Properly sets CA info
• The main sx_http.c HTTP client does NOT disable cert verification by default (only specific tools do)

5.3 Token Transport Over HTTP (⚠ RISK)

Several token fetch endpoints use plain HTTP (not HTTPS):

• http://token.scorpiox.net/claude — OAuth tokens over HTTP
• http://token.scorpiox.net/codex — OAuth tokens over HTTP
• http://token.scorpiox.net/gemini — OAuth tokens over HTTP
• http://scorpiox.net:5176 — Router URL over HTTP
• http://192.168.1.12:8045/v1/messages — API proxy on LAN (HTTP)
• TCP_HOST 20.53.240.54:9800 — Raw TCP token fetch (no encryption)

---

6. Data Flow Diagrams

6.1 AI Chat Flow

User Input → sx.c → sx_agent.c → sx_provider_*.c
                                       │
                ┌──────────────────────┼──────────────────────┐
                ▼                      ▼                      ▼
        api.anthropic.com    chatgpt.com/backend-api   googleapis.com
        (Claude API)         (Codex API)               (Gemini API)
                │                      │                      │
                ▼                      ▼                      ▼
           AI Response → sx_agent.c → sx.c → Display
                                       │
                                       ├── emit_session_msg() ──→ code.scorpiox.net/sessions-send
                                       └── scorpiox-usage ──────→ code.scorpiox.net/usage-send

6.2 Token Acquisition Flow

sx_provider_claude_code.c → load_oauth_token_ex()
      │
      ├── LOCAL:  Read ~/.claude/.credentials.json (no network)
      ├── SSH:    SSH to CLAUDE_CODE_SSH_HOST → read credentials
      ├── REMOTE: HTTP GET http://token.scorpiox.net/claude
      └── TCP:    Raw TCP to TCP_HOST:TCP_PORT (SXV1 protocol)
                       │
                       ▼
              scorpiox-server-fetchtoken (TCP:9800)
                       │
                       ▼
              HTTP upstream (localhost:8087/claude)

6.3 Update/Distribution Flow

scorpiox-wsl.c → check_for_update()
      │
      ▼
  dist.scorpiox.net/executables/scorpiox-wsl.exe
      │
      ▼
  Compare binary size → Replace if different

scorpiox-vm.c → download VM images / BIOS firmware
      │
      ▼
  dist.scorpiox.net/container-images/
  dist.scorpiox.net/firmware/bios-256k.bin

6.4 FRP Tunnel Flow

Local Service (port N) ←── sx_frp.c ──→ frps server (port 7000)
                          TCP + yamux      │
                          AES-128-CFB      ▼
                          (optional TLS)  Remote clients

---

7. Embedded Credentials / API Keys

⚠ CRITICAL FINDING: The WASM embedded configuration contains hardcoded API keys:

These are compiled into the WASM binary and could be extracted by anyone with access to it.

---

8. DNS Resolution Analysis

8.1 Domains Resolved at Runtime

All domains below are resolved via getaddrinfo() or libcurl's internal resolver:

• api.anthropic.com — AI API
• console.anthropic.com — OAuth
• auth.openai.com — OAuth
• chatgpt.com — Codex API
• generativelanguage.googleapis.com — Gemini API
• api.z.ai — Z.AI proxy
• api.openai.com — OpenAI API
• *.scorpiox.net — Multiple services (token, dist, code, whisper, login, opus, relay, etc.)
• search.brave.com, www.mojeek.com, html.duckduckgo.com — Web search engines
• Various other search engines (Google, Bing, Yahoo, Yandex, Ecosia, Startpage, Qwant, SearX)
• User-configured SMTP hosts, FRP servers, SSH hosts

8.2 DNS Server (scorpiox-dns.c)

• Built-in DNS server that can serve custom zones for *.scorpiox.net
• Upstream forwarding to 8.8.8.8 and 1.1.1.1 (configurable)
• Split-horizon support (different IPs for LAN vs WAN)
• Active caching with background refresh
• DNS audit logging (opt-in via DNS_AUDIT_LOG=1)

---

9. Risk Assessment

Critical Risks

High Risks

Medium Risks

Low Risks

---

10. Recommendations

IMMEDIATE: Remove hardcoded API keys from sx_config_embedded.c. Use environment variables or secure key management.

IMMEDIATE: Enable SSL certificate verification on all token fetch/refresh paths. Remove all SSL_VERIFYPEER=0 fallbacks.

HIGH: Migrate all token.scorpiox.net endpoints from http:// to https://.

HIGH: Add TLS to the TCP fetchtoken protocol (sx_tcp_fetch.c), or migrate to HTTPS.

HIGH: Implement binary signature verification for auto-updates (e.g., Ed25519 signatures).

MEDIUM: Add input sanitization for session IDs passed to system() calls in telemetry.

MEDIUM: Enable FRP TLS with proper certificate validation.

MEDIUM: Document all network endpoints and their purpose for operators.

LOW: Consider making telemetry endpoints configurable (already partially done via *_API_URL configs).

LOW: Add network activity audit logging as a built-in feature.

---

Report generated by Security Audit Agent — 2026-04-28