ClawHub
Back to skill

Security audit

Domainion Ops

Security checks for vulnerabilities and agentic risk

Overview

This domain-management skill is coherent, but it can make high-impact registrar changes and its examples risk exposing registrar credentials.

Install only if you are comfortable giving the agent registrar-level authority. Use sandbox accounts first, avoid pasting production secrets into visible commands, store credentials with restrictive permissions, require explicit confirmation before purchases, renewals, DNS replacements, nameserver changes, unlocks, or transfer-code requests, and rotate any registrar keys that may have appeared in logs or command traces.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
references/godaddy.md:15
Finding

GoDaddy API Credentials Exposed Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
references/name-com.md:10
Finding

name.com API Token Exposed Through Curl Command-Line Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
references/namecheap.md:34
Finding

Namecheap API Key and Personal Data Exposed in Request URLs

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (83)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

1. Check domain availability

bash
# name.com (default)
curl -u "$NAMECOM_USERNAME:$NAMECOM_TOKEN" \
  "https://api.name.com/v4/domains:checkAvailability" \
  -d '{"domainNames":["example.com"]}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/godaddy.md (reported line 3)May include surrounding context.

md
# GoDaddy API Reference

Base URL: `https://api.godaddy.com/v1`
Auth: `Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET`

Get credentials: developer.godaddy.com → API Keys → Create New Key

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/godaddy.md (reported line 8)May include surrounding context.

md
# GoDaddy API Reference

Base URL: `https://api.godaddy.com/v1`
Auth: `Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET`

Get credentials: developer.godaddy.com → API Keys → Create New Key

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/godaddy.md (reported line 17)May include surrounding context.

md
# GoDaddy API Reference

Base URL: `https://api.godaddy.com/v1`
Auth: `Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET`

Get credentials: developer.godaddy.com → API Keys → Create New Key

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/godaddy.md (reported line 24)May include surrounding context.

md
# GoDaddy API Reference

Base URL: `https://api.godaddy.com/v1`
Auth: `Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET`

Get credentials: developer.godaddy.com → API Keys → Create New Key

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/godaddy.md (reported line 31)May include surrounding context.

md
# GoDaddy API Reference

Base URL: `https://api.godaddy.com/v1`
Auth: `Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET`

Get credentials: developer.godaddy.com → API Keys → Create New Key

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/godaddy.md (reported line 37)May include surrounding context.

md
# GoDaddy API Reference

Base URL: `https://api.godaddy.com/v1`
Auth: `Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET`

Get credentials: developer.godaddy.com → API Keys → Create New Key

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/godaddy.md (reported line 44)May include surrounding context.

md
# GoDaddy API Reference

Base URL: `https://api.godaddy.com/v1`
Auth: `Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET`

Get credentials: developer.godaddy.com → API Keys → Create New Key

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/godaddy.md (reported line 61)May include surrounding context.

md
# GoDaddy API Reference

Base URL: `https://api.godaddy.com/v1`
Auth: `Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET`

Get credentials: developer.godaddy.com → API Keys → Create New Key

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/godaddy.md (reported line 68)May include surrounding context.

md
# GoDaddy API Reference

Base URL: `https://api.godaddy.com/v1`
Auth: `Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET`

Get credentials: developer.godaddy.com → API Keys → Create New Key

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/godaddy.md (reported line 76)May include surrounding context.

md
# GoDaddy API Reference

Base URL: `https://api.godaddy.com/v1`
Auth: `Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET`

Get credentials: developer.godaddy.com → API Keys → Create New Key

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/godaddy.md (reported line 86)May include surrounding context.

md
# GoDaddy API Reference

Base URL: `https://api.godaddy.com/v1`
Auth: `Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET`

Get credentials: developer.godaddy.com → API Keys → Create New Key

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/godaddy.md (reported line 98)May include surrounding context.

md
# GoDaddy API Reference

Base URL: `https://api.godaddy.com/v1`
Auth: `Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET`

Get credentials: developer.godaddy.com → API Keys → Create New Key

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/godaddy.md (reported line 106)May include surrounding context.

md
# GoDaddy API Reference

Base URL: `https://api.godaddy.com/v1`
Auth: `Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET`

Get credentials: developer.godaddy.com → API Keys → Create New Key

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/godaddy.md (reported line 119)May include surrounding context.

md
# GoDaddy API Reference

Base URL: `https://api.godaddy.com/v1`
Auth: `Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET`

Get credentials: developer.godaddy.com → API Keys → Create New Key

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/godaddy.md (reported line 125)May include surrounding context.

md
# GoDaddy API Reference

Base URL: `https://api.godaddy.com/v1`
Auth: `Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET`

Get credentials: developer.godaddy.com → API Keys → Create New Key

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/godaddy.md (reported line 131)May include surrounding context.

md
# GoDaddy API Reference

Base URL: `https://api.godaddy.com/v1`
Auth: `Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET`

Get credentials: developer.godaddy.com → API Keys → Create New Key

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/godaddy.md (reported line 139)May include surrounding context.

md
# GoDaddy API Reference

Base URL: `https://api.godaddy.com/v1`
Auth: `Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET`

Get credentials: developer.godaddy.com → API Keys → Create New Key

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/godaddy.md (reported line 162)May include surrounding context.

md
# GoDaddy API Reference

Base URL: `https://api.godaddy.com/v1`
Auth: `Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET`

Get credentials: developer.godaddy.com → API Keys → Create New Key

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/godaddy.md (reported line 171)May include surrounding context.

md
# GoDaddy API Reference

Base URL: `https://api.godaddy.com/v1`
Auth: `Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET`

Get credentials: developer.godaddy.com → API Keys → Create New Key

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/godaddy.md (reported line 179)May include surrounding context.

md
# GoDaddy API Reference

Base URL: `https://api.godaddy.com/v1`
Auth: `Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET`

Get credentials: developer.godaddy.com → API Keys → Create New Key

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The authentication example embeds API key and secret usage directly in command lines without an accompanying warning about secret exposure risks in shell history, logs, screenshots, or agent traces. In an agent skill context, this increases the chance that credentials are copied, surfaced to users, or propagated into telemetry.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/godaddy.md (reported line 7)May include surrounding context.

md
Auth: `Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET`

Get credentials: developer.godaddy.com → API Keys → Create New Key
- **OTE (test):** `https://api.ote-godaddy.com/v1` (sandbox)
- **Production:** `https://api.godaddy.com/v1`

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/godaddy.md (reported line 16)May include surrounding context.

Check domain availability

bash
curl -H "Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET" \
  "https://api.godaddy.com/v1/domains/available?domain=example.com"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The purchase example performs a billable, account-affecting action but lacks a prominent warning that it can incur real charges and register a live domain. In a domain-management skill, this omission makes accidental financial and ownership changes more likely during automated or semi-automated use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.