Gandi - Registrar & DNS

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:03 AM UTC
• Version: 0.2.7

Overview

This is a powerful but clearly disclosed Gandi domain-management skill, with risks that mainly come from using write-capable registrar tokens and destructive commands.

Install only if you intend to manage Gandi domains from this skill. Prefer separate read-only and write tokens, grant the minimum scopes needed, do not print or store tokens in shell profiles, create DNS snapshots before changes, and carefully review any --force, bulk DNS, DNSSEC, registration, renewal, certificate, or email-forward command before running it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (15)

Intent-Code Divergence

Medium

• Confidence: 80% confidence
• Finding: The security section says write scopes are 'future' even though the rest of the document clearly describes current DNS and email write operations. This kind of contradiction can mislead operators into granting or reviewing the wrong privileges, weakening change control around destructive account actions.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The documentation advertises DNSSEC and AXFR/TSIG management capabilities that are more security-sensitive than the high-level manifest description suggests. This can cause reviewers or users to underestimate the skill's ability to alter trust chains or enable zone transfer configurations, increasing the risk of misuse or overly broad delegation.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The script explicitly tells users it 'updates existing records' and directs them to a different script for adding new ones, but its actual behavior will create a record when none exists because it falls through to createDnsRecord after a 404. In a DNS-management skill with destructive write access, this semantic mismatch can cause unintended DNS changes, making operator mistakes more likely and potentially breaking routing, mail delivery, or verification records.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This documentation covers account-impacting operations such as domain registration, renewal, transfer, lock changes, and transfer cancellation without consistently flagging that these actions can incur charges, interrupt ownership workflows, or alter security posture. In an agent skill that supports both read-only and destructive actions, omitting explicit warnings and confirmation requirements increases the risk that an automated or unsuspecting user triggers irreversible or costly domain changes.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Nameserver and contact updates can immediately redirect traffic, break email, disrupt DNS resolution, or expose/replace registrant information, yet the instructions do not clearly emphasize these operational and privacy risks. Because this skill is designed for domain and DNS management, under-warning these actions makes accidental outage, hijack-facilitating misconfiguration, or unauthorized data changes more likely.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: Bulk record replacement is a destructive operation that can wipe or misconfigure an entire zone if invoked incorrectly, yet the documentation does not prominently warn that existing records may be overwritten. In an agent skill context, missing safety language increases the chance of accidental service outage, mail disruption, or takeover-facilitating misconfiguration.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Deleting DNS records can immediately break website routing, email delivery, verification flows, or security controls, but the documentation presents deletion without an explicit warning about operational impact. In an automation setting, this omission can lead to unintended outages from mistaken record names, types, or targets.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: Snapshot restore overwrites the current DNS configuration, potentially reverting valid records, removing recent changes, or reintroducing stale insecure settings. Without a clear overwrite warning, users or agents may trigger restores that cause broad service interruption across web, mail, and validation systems.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The setup guide tells users to print the full API token with `cat ~/.config/gandi/api_token` as a verification step, which unnecessarily exposes a live secret on screen. In the context of a domain/DNS management skill with potentially write-capable tokens, this increases risk of shoulder-surfing, screen recording leakage, terminal scrollback retention, or accidental copy/paste exposure.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The script prints organization labels/names and sharing IDs to stdout as part of a status command. While not equivalent to exposing the API token, these identifiers are still sensitive operational metadata that may leak into terminal logs, CI logs, screen recordings, or support transcripts and aid reconnaissance against the account.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The remove action performs a destructive operation immediately after parsing the profile name, with no confirmation prompt, dry-run, or force flag gating. In a CLI that manages registrar credentials and multi-domain organization profiles, an accidental invocation or scripted misuse can delete a profile unexpectedly, potentially disrupting administration or causing loss of stored configuration references.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# Delete with confirmation prompt
node delete-email-forward.js example.com old

# Delete without confirmation
node delete-email-forward.js example.com old --force

# Delete catch-all forward

• Confidence: 84% confidence
• Finding: without confirmation

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### delete-dns-record.js
- **Purpose:** Delete a DNS record
- **Network calls:** DELETE /v5/livedns/domains/{domain}/records/{name}/{type} (Gandi API)
- **Side effects:** ⚠️ **DELETES DNS RECORD** - can break websites/email
- **Usage:** `node delete-dns-record.js example.com old A [--force]`
- **What it does:**

• Confidence: 88% confidence
• Finding: DELETE /v5/livedns/domains/{domain}/records/{name}/{type}

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### delete-email-forward.js
- **Purpose:** Delete email forward
- **Network calls:** DELETE /v5/email/forwards/{domain}/{mailbox} (Gandi API)
- **Side effects:** ⚠️ **STOPS EMAIL FORWARDING** - emails will bounce
- **Usage:** `node delete-email-forward.js example.com mailbox [--force]`
- **What it does:**

• Confidence: 89% confidence
• Finding: DELETE /v5/email/forwards/{domain}/{mailbox}

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

export GANDI_API_TOKEN="YOUR_PERSONAL_ACCESS_TOKEN"

# Add to shell profile for persistence (~/.bashrc, ~/.zshrc, etc.)
echo 'export GANDI_API_TOKEN="YOUR_PERSONAL_ACCESS_TOKEN"' >> ~/.bashrc
```

**Benefits:**

• Confidence: 78% confidence
• Finding: echo 'export GANDI_API_TOKEN="YOUR_PERSONAL_ACCESS_TOKEN"' >> ~/.bashrc

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/check-ssl.js:21