T09 · Insecure Skill Coding Practices
Error
- Location
namecheap-dns.js:173- Finding
OS Command Injection Through Unvalidated Domain Input
- Content
View full analysis
- Remediation
View remediation
Security audit
Namecheap DNS
Security checks for vulnerabilities and agentic risk
Overview
The skill has a clear Namecheap DNS purpose, but it can make high-impact DNS changes and contains unsafe command and restore handling that users should review before installing.
Install only if you are comfortable giving this tool Namecheap DNS credentials and reviewing commands before they run. Treat it as Review-worthy until domain validation, shell-safe dig execution, backup path containment, backup schema validation, and restore target-domain confirmation are fixed; use a least-privilege API key if available and keep backups in a private directory.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
namecheap-dns.js:396- Finding
Backup Path Traversal and Unvalidated Restore Data
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
namecheap-dns.js:680- Finding
Restore Operation Does Not Bind Backup Data to the Target Domain
- Content
View full analysis
setTimeout(resolve, 3000)); // Safety check for ghost records const safe = await safetyCheck(domain, force); if (!safe) { process.exit(1); } // Create backup of current state before restoring createBackup(domain, currentHosts); console.log('⚙️ Restoring from backup...'); await setHosts(domain, backup.apiHosts); ``` ### Technical Analysis Backups include a `domain` field, but the restore workflow never verifies that `backup.domain` matches the domain supplied on the command line. The contents of a backup created for one domain can therefore be sent to another domain. This is particularly dangerous because `setHosts` replaces all API-visible DNS records. The operation also lacks a true affirmative confirmation: it merely waits three seconds and continues unless the user interrupts the process. The ghost-record safety check does not prevent this issue. It only detects records visible through DNS but missing from the API; it does not establish that the selected backup belongs to the target domain. ### Attack Path 1. A backup exists for domain A. 2. An operator, Agent, or attacker selects that backup while specifying domain B as the restore target. 3. The Skill loads the backup but does not compare `backup.domain` with domain B. 4. The current record ...[truncated 716 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
namecheap-dns.js:79- Finding
Namecheap API Credential Transmitted in URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (27)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./namecheap-dns.js verify example.com
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./namecheap-dns.js verify example.com
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./namecheap-dns.js verify example.com
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./namecheap-dns.js verify example.com
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./namecheap-dns.js verify example.com
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./namecheap-dns.js verify example.com
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./namecheap-dns.js verify example.com
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./namecheap-dns.js verify example.com
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./namecheap-dns.js verify example.com
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./namecheap-dns.js verify example.com
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./namecheap-dns.js verify example.com
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./namecheap-dns.js verify example.com
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./namecheap-dns.js verify example.com
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 90% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
md --txt "test=hello" \ --dry-run # Force override safety check (if you know ghost records can be deleted) ./namecheap-dns.js add example.com \ --txt "test=hello" \ --force
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 90% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
js --txt "test=hello" \ --dry-run # Force override safety check (if you know ghost records can be deleted) ./namecheap-dns.js add example.com \ --txt "test=hello" \ --force
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
md --txt "test=hello" \ --dry-run # Force override safety check (if you know ghost records can be deleted) ./namecheap-dns.js add example.com \ --txt "test=hello" \ --force
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
js --txt "test=hello" \ --dry-run # Force override safety check (if you know ghost records can be deleted) ./namecheap-dns.js add example.com \ --txt "test=hello" \ --force
Known Vulnerable Dependency: axios==1.13.5 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The lockfile pins axios 1.13.5, and the supplied advisory set includes multiple high-severity issues such as SSRF-related proxy bypass and prototype-pollution-driven request/response compromise. In a DNS management skill that makes authenticated outbound API calls, weaknesses in the HTTP client are especially relevant because they can expose credentials, alter requests, or redirect sensitive traffic.
- Content
Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
form-data 4.0.5 is flagged for CRLF injection via unescaped multipart field names and filenames. This skill appears primarily focused on DNS API operations, so multipart handling may not be central, but the vulnerable package is still present and could become exploitable if any user-controlled multipart requests are introduced or indirectly used by dependencies.
- Content
Known Vulnerable Dependency: axios==1.13.5 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more
High
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
The package permits installation of axios 1.13.5 via the semver range, and the static analysis reports that version as having multiple known advisories, including SSRF and prototype-pollution-related exploitation paths. For a tool that manages DNS through remote API calls, flaws in the HTTP client can materially affect request integrity, proxy handling, credential exposure, or response trust.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill requires sensitive environment variables such as NAMECHEAP_API_KEY, NAMECHEAP_USERNAME, and NAMECHEAP_API_USER, but it does not declare any explicit tool scope or permissions boundary. This weakens reviewability and increases the chance that a host agent exposes secrets to the skill without clear user consent or least-privilege controls.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js const __dirname = dirname(fileURLToPath(import.meta.url)); const API_BASE = 'https://api.namecheap.com/xml.response'; // Configurable backup directory function getBackupDir() {
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
js const value = process.env[key]; if (!value) { console.error(`❌ Error: ${key} environment variable not set`); console.error(` Add to ~/.zshrc: export ${key}="your-value"`); process.exit(1); } return value;
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill builds shell commands with untrusted domain input using execSync(
dig +short ${fullDomain} ${type}) and similar calls for subdomains. Because shell metacharacters in the domain are not validated or escaped, an attacker can achieve OS command injection, which is materially more dangerous than the stated DNS-management purpose of the skill.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Backups persist complete DNS state, including TXT records that often contain SPF, DKIM, verification tokens, and internal mail-routing details, to local JSON files without any warning, permission hardening, or opt-in. This creates a confidentiality risk if the workstation, repo directory, or backup path is shared, synced, or world-readable.
- Content
Static analysis
Detected: suspicious.dangerous_exec, suspicious.env_credential_access
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- namecheap-dns.js:127
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- namecheap-dns.js:16