Domain availability API built for AI agents. Check single domains, explore names across .com/.io/.ai/.dev/etc, filter by budget, get smart suggestions. Returns proper JSON/TXT with correct Content-Type headers.

• Outcome: Review
• Latest audit: May 28, 2026, 2:00 AM
• Version:
  1.0.1

Overview

This is a coherent domain-registrar skill, but it gives agents power to spend money and change domain control without clear confirmation safeguards.

Install only if you want an agent to manage real domains through ClawDaddy. Before using it, require explicit approval for purchases, payments, DNS edits, nameserver updates, transfer actions, recovery, or settings changes, and treat each management token like a password that should not be pasted into logs or broad chat history.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README promotes domain purchases, DNS changes, nameserver updates, and transfer-related actions without any caution that these operations can be irreversible, cost-incurring, or disruptive to existing services. In an agent-skill context, that omission is dangerous because an AI agent or user may treat these actions as routine API calls and trigger billing, outages, or loss of domain control without explicit confirmation safeguards.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The workflow tells users to 'save managementToken' and then use it as a bearer token, but never labels it as a secret credential or warns against logging, sharing, or storing it insecurely. Because this token appears to grant control over DNS, nameservers, settings, and transfer actions, mishandling it could enable full unauthorized management of the purchased domain.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill enables real-world domain purchases and destructive configuration changes such as DNS and nameserver updates, but it does not require an explicit user confirmation step or present warnings about service disruption, transfer lock implications, or irreversible payment effects. In an agent setting, this creates a meaningful risk of unintended purchases, website/email outages, or loss of control if the agent acts on ambiguous or injected instructions.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The workflow examples normalize executing purchases and domain-management actions immediately after a user request, with no confirm-before-act step. Because these examples guide agent behavior, they increase the chance that an agent will spend money, alter DNS, or switch nameservers without verifying ownership, intent, or understanding of operational impact.

VirusTotal

66/66 vendors flagged this skill as clean.