ClawHub
Back to skill

Security audit

Domain Name Checker

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate domain-checking skill with optional LLM brainstorming, but users should notice that brainstorming uses OpenRouter and may send their project description to that service.

Install only if you are comfortable with DNS/whois lookups for checked domains and with brainstorm mode sending your description to OpenRouter using OPENROUTER_API_KEY. Avoid putting confidential product details, customer data, or secrets in brainstorm prompts, and prefer a locked dependency workflow if running it directly.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/check.py:2
Finding

Unpinned Third-Party Runtime Dependencies

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/check.py:129
Finding

User-Controlled Rich Markup Enables Deceptive Terminal Output

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)

Tainted flow: 'api_key' from os.environ.get (line 152, credential/environment) → httpx.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/check.py (reported line 163)May include surrounding context.

python
)

    try:
        resp = httpx.post(
            "https://openrouter.ai/api/v1/chat/completions",
            headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"},
            json={

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill description claims 'No API key required,' but the documented brainstorming feature requires OPENROUTER_API_KEY and external network access, creating a misleading description-to-behavior mismatch. This is dangerous because users and agent frameworks may trust the manifest's lower-risk presentation while the skill actually performs additional remote interactions and may prompt for or consume sensitive credentials.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding

The skill invokes a Python script that inherently uses shell, network, and environment capabilities, yet the manifest does not declare any tool scope or permissions boundary. This is dangerous because an agent or reviewer cannot accurately understand or constrain what the skill may access, increasing the chance of unintended network calls, subprocess execution, or environment-variable exposure during use.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check.py (reported line 37)May include surrounding context.

python
def dns_check(domain: str, timeout: int = 3) -> str:
    """Return 'available', 'taken', or 'unknown'. Uses dig subprocess for reliable timeout."""
    try:
        result = subprocess.run(
            ["dig", "+short", "+time=2", "+tries=1", domain, "A"],
            capture_output=True, text=True, timeout=timeout + 1
        )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check.py (reported line 73)May include surrounding context.

python
def whois_check(domain: str) -> str | None:
    """Optional whois cross-check. Returns 'available', 'taken', or None if whois unavailable."""
    try:
        result = subprocess.run(
            ["whois", domain],
            capture_output=True, text=True, timeout=8
        )

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill metadata claims no API key is required, but the brainstorm path reads OPENROUTER_API_KEY and sends prompts to an external LLM service. This is dangerous because users may invoke the skill under false assumptions about credential use and network disclosure, weakening informed consent and trust boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The brainstorm feature sends user-provided descriptions to an external LLM service without a clear warning in the skill description. That is dangerous because users may include confidential product ideas, customer data, or internal project details, assuming the tool only performs domain lookups.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill accesses an environment credential for functionality that is ancillary to the advertised purpose and not clearly disclosed in the description. In agent ecosystems, undeclared credential access is risky because users may grant or expose secrets to a tool they believe is only doing local/network domain checks.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/check.py (reported line 163)May include surrounding context.

python
)

    try:
        resp = httpx.post(
            "https://openrouter.ai/api/v1/chat/completions",
            headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"},
            json={

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation is internally inconsistent: top-level text says no API key is required while the brainstorm code path depends on OpenRouter credentials. This inconsistency is a security-relevant transparency issue because it can mislead users about external dependencies and data handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.