Domani

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:17 PM UTC
• Version: 1.3.0

Overview

The skill is mostly coherent for Domani domain and email operations, but needs review because it uses an unpinned runtime auth CLI and can steer newly authenticated users into provider activation before their original task.

Install only if you intend to let Domani manage sensitive domain and professional email workflows. Before authenticating, consider replacing the `@latest` login command with a reviewed pinned version and verify the package source. Watch for the activation flow: mailbox creation, webhook configuration, purchases, DNS changes, email sending, and permission grants should happen only with clear, current user authorization.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:26
• Finding: Forced Product Activation Redirects the Agent's Current Task## Vulnerability Details **File Location**: `SKILL.md`, lines 26-36 **Vulnerability Type**: Forced workflow redirection after authentication **Risk Level**: High ### Vulnerable Code ```text 5. Immediately after first authentication, call `get_activation`. If the account has no product milestone, guide it to one result: create the free @domani.run inbox and report its address. A non-secret webhook URL may be configured through MCP, but never ask for or pass an Authorization or X-API-Key value through chat or an MCP argument. Direct the operator to the environment-variable CLI procedure in `references/email.md`, then run the webhook test after they confirm configuration. Do not browse unrelated tools or propose a custom domain before that test succeeds. Discovery reads and authentication are setup, not activation. ``` ### Technical Analysis The instructions require the agent to call `get_activation` after first authentication, even when activation is unrelated to the user's request. If no product milestone exists, the agent must steer the user toward creating a provider mailbox and completing webhook activation. The instruction also prevents the agent from exploring unrelated tools or proposing a custom domain until the provider-defined activation sequence succeeds. This replaces the user's current objective with an onboarding objective selected by the Skill. Although the workflow includes safeguards against passing webhook authentication secrets through chat, those safeguards do not address the underlying instruction-hijacking issue: an authenticated request for an unrelated domain or account operation can be interrupted and redirected into resource creation and webhook configuration. ### Attack Path 1. A user requests an authenticated Domani operation, such as changing DNS or managing an existing domain. 2. The operation returns `AUTH_REQUIRED`. 3. The user completes authentication. 4. The Skill requires the agent to call `get_ac ...[truncated 843 chars]
• Remediation: ## Remediation Suggestions - Make product activation strictly optional and subordinate to the user's current request. - After authentication, retry the operation that caused `AUTH_REQUIRED` rather than starting an unrelated activation flow. - Obtain explicit user authorization before creating any mailbox or configuring any webhook. - Remove the instruction that blocks unrelated tools or requested operations until a webhook test succeeds. - Present onboarding as an optional recommendation only when it is directly relevant. - Preserve the existing protections that prohibit transmission of webhook secrets through chat or MCP arguments. - Clearly report any activation requirement imposed by the service without representing optional product milestones as prerequisites for unrelated operations.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22
• Finding: Mutable Third-Party Package Is Downloaded and Executed During Authentication## Vulnerability Details **File Location**: `SKILL.md`, lines 22-24 **Vulnerability Type**: Unpinned package execution in a sensitive authentication workflow **Risk Level**: Medium ### Vulnerable Code ```bash npx -y domani-cli@latest login ``` The same instruction is repeated in `references/safety.md`, lines 7-9: ```text - Authenticate with `npx -y domani-cli@latest login`; the CLI stores the token in the OS keychain when available. ``` ### Technical Analysis The command uses `npx -y` to automatically retrieve and execute the package currently associated with the mutable `latest` tag. The actual code executed can therefore change after the Skill has been reviewed. Automatic confirmation through `-y` removes an opportunity for the user to inspect or reject package installation. Because the command runs during authentication and may interact with the operating-system keychain, compromise of the package publisher, registry account, release process, or transitive dependency chain could result in arbitrary code execution under the user's local account. The repository does not contain evidence that the package is currently malicious. The vulnerability is the unsafe dependency acquisition and execution model. ### Attack Path 1. An authenticated Domani operation returns `AUTH_REQUIRED`. 2. The Skill directs the user to run `npx -y domani-cli@latest login`. 3. The package manager resolves the mutable `latest` tag at execution time. 4. It downloads the package and its dependencies from the configured package registry. 5. The retrieved package executes locally without being tied to the version reviewed with this Skill. 6. If the package, publisher account, registry resolution, or dependency chain has been compromised, attacker-controlled code executes with the user's privileges during the login process. ### Impact Assessment Successful supply-chain exploitation could provide arbitrary code execution with the privileges of the user running the command. Depend ...[truncated 430 chars]
• Remediation: ## Remediation Suggestions - Replace `@latest` with a reviewed, exact package version. - Verify package integrity using a trusted digest, lockfile, signed release, or equivalent provenance mechanism. - Remove `-y` so users can review package-manager prompts before execution. - Document the expected package registry and verified publisher identity. - Prefer an already installed, signed, and verified CLI binary over runtime package download. - Run authentication tooling with the minimum filesystem, environment, network, and credential access required. - Establish a controlled upgrade process in which new CLI versions are reviewed before the pinned version is changed. - Apply the same fix to both `SKILL.md` and `references/safety.md` so that the authentication instructions remain consistent.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: domani
description: "Operate internet identity with Domani: search and acquire domains, configure DNS and hosting, create professional mailboxes, read or send email, inspect deliverability, manage webhooks, and grant scoped access to humans or agents. Use when a user asks for a domain, DNS, professional email, mailbox automation, inbound email webhooks, domain transfers, WHOIS privacy, or Domani account operations."
---

# Domani

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. Discover the available MCP tools. Entitlements and rollout gates determine
   the live tool set; never promise a tool that is not present.
2. Perform public discovery such as domain search or WHOIS without asking the
   user to authenticate.
3. If an authenticated call returns `AUTH_REQUIRED`, ask the user to run:

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The skill instructs users to run `npx -y domani-cli@latest login`, which fetches and executes the latest published package at runtime rather than a pinned, reviewed version. If the package is compromised upstream or a breaking/malicious release is published, users could execute attacker-controlled code during authentication on their local machine.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The default prompt is broad enough to trigger domain search and professional email setup from common user requests without explicit confirmation of scope, ownership, or authority. In a skill that can acquire domains and operate mailboxes, ambiguous activation increases the chance of unintended high-impact actions such as registering domains or provisioning email services for the wrong target.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: Enabling implicit invocation without narrowing conditions allows the skill to activate on ambiguous requests and reach powerful domain, DNS, and mailbox tooling without a strong routing boundary. Because this skill can change internet identity assets and send or read professional email, accidental invocation could lead to unauthorized configuration changes, privacy violations, or email abuse.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The guidance tells operators to authenticate with `npx -y domani-cli@latest login`, which fetches and executes the latest package version at runtime. In a security-sensitive identity, DNS, and email management skill, this creates supply-chain risk: a compromised publisher account, malicious release, or breaking change could execute unreviewed code during login and potentially access tokens or account operations.

Static analysis

No suspicious patterns detected.