ClawHub
Back to skill

Security audit

Domain availability API built for AI agents. Check single domains, explore names across .com/.io/.ai/.dev/etc, filter by budget, get smart suggestions. Returns proper JSON/TXT with correct Content-Type headers.

Security checks across malware telemetry and agentic risk

Overview

This is a coherent domain registrar skill, but it gives agents power to spend money and change live domain control without clear confirmation and secret-handling safeguards.

Install only if you want an agent to manage real domains through ClawDaddy. Require explicit approval before purchases, payments, DNS edits, nameserver updates, transfers, recovery, or settings changes, and treat every management token like a password.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The README explicitly promotes purchasing domains and making management changes such as DNS updates, nameserver changes, locking, and transfers, but it does not warn that these actions can incur charges, cause outages, or make hard-to-reverse account changes. In an agent-skill context, omission of user-confirmation and risk guidance increases the chance that an autonomous agent could take destructive or billable actions without informed user consent.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The workflow instructs users or agents to save and reuse a bearer-style management token, but provides no warning that this credential grants control over domain configuration and could enable takeover-like actions if exposed. In this skill context, the token can be used to modify DNS, nameservers, settings, or transfer state, so mishandling it materially raises the risk of service disruption or unauthorized domain management.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill provides ready-to-use nameserver and DNS modification workflows that can disrupt live websites, email delivery, and verification records, but it does not explicitly warn that these actions are service-affecting and should only be performed with clear user confirmation. In an agent context, this increases the chance that an automated system will execute a technically valid but operationally destructive change based on ambiguous or incomplete user requests.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.