LobsterDomains

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:11 AM UTC
• Version: 1.0.1

Overview

The skill is mostly coherent for domain registration, but it tells the agent to expose high-value domain management passwords directly in chat, including from order history.

Review this carefully before installing. Use it only if you are comfortable with the agent handling domain registration data, crypto payment references, and OpenSRS management credentials. Avoid querying broad order history unless you need it, and rotate or change any domain management password after receiving it through chat.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:111

Finding

Domain Management Credentials Exposed Through Conversational Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 111–132
Vulnerability Type: Plaintext disclosure and insecure handling of domain-management credentials
Risk Level: High

Vulnerable Code

markdown

"opensrsUsername": "...",
"opensrsPassword": "...",
"managementUrl": "https://..."
}

> Important: The response includes opensrsUsername and opensrsPassword for post-purchase DNS and transfer management. Always present these credentials directly to the user and instruct them to store the credentials securely (e.g., in a password manager). Never persist these credentials in conversation history, logs, or any file. These are sensitive third-party credentials that grant full control over the registered domain.

5. Query Orders

Retrieve order history.

text

GET /api/v1/orders
GET /api/v1/orders?domain={domain}

Returns up to 50 latest orders. Results may include OpenSRS management credentials — always present these to the user directly and remind them to store credentials securely.

text

### Technical Analysis

The Skill instructs the agent to place OpenSRS usernames and passwords directly into ordinary conversational output. These credentials grant management access to registered domains and therefore constitute high-value authentication secrets.

This instruction conflicts with the accompanying requirement not to persist the credentials in conversation history or logs. Once a secret is inserted into a normal agent response, the Skill cannot guarantee that it will be excluded from platform transcripts, observability systems, telemetry, model context, browser history, transcript exports, or other retention mechanisms.

The order-history endpoint increases the exposure scope because it may return credentials for as many as 50 recent orders. Repeatedly presenting those credentials can expose both newly issued and previously issued domain-management secrets.

### Attack Path

...[truncated 1635 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction requiring the agent to display OpenSRS passwords in ordinary conversational responses.
2. Do not include reusable management credentials in domain-registration or order-history API responses.
3. Return a short-lived, single-use HTTPS retrieval link instead of the password itself.
4. Require explicit reauthentication before allowing credential retrieval.
5. Bind retrieval links to the authenticated user, apply strict expiration, and invalidate each link immediately after use.
6. Ensure secrets are redacted from application logs, API traces, telemetry, analytics, error reports, and model context.
7. Exclude management credentials from order-history listings. Provide a separate audited credential-recovery workflow when necessary.
8. Rotate or invalidate the initial credential after its first successful retrieval and encourage the user to set a new password.
9. Apply appropriate response headers, including Cache-Control: no-store, to any endpoint that handles credential material.
10. Notify the user that sensitive credentials are available through a secure retrieval channel without reproducing those credentials in chat.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep