Security audit
Security checks for vulnerabilities and agentic risk
The skill is a mostly coherent DDNS helper, but its instructions can turn ordinary public-IP questions into DNS-changing updates using a provider token.
Review this before installing if you want strict control over DNS changes. Use only explicit DDNS update prompts, keep the dynv6 token scoped appropriately, and verify the missing referenced scripts before relying on it. Treat public-IP-only requests as read-only unless you intentionally want DNS records updated.
The trigger guidance is broad enough to activate on ordinary requests about public IPs or DNS, which can cause the agent to run networked scripts and potentially update DNS records when the user only wanted informational help. In an agent setting, overbroad invocation criteria increase the chance of unintended side effects from ambiguous natural-language requests.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## Quick start
### 1️⃣ Create the config file
**Outside** the skill directory, in your home config folder:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
} EOF
chmod 600 ~/.config/picoclaw-ddns/config.json
> 🔒 **Why chmod 600?** The token is sensitive — only the file owner should read it.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
} EOF
chmod 600 ~/.config/picoclaw-ddns/config.json
> 🔒 **Why chmod 600?** The token is sensitive — only the file owner should read it.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| Concern | Mitigation |
|---------|------------|
| Token leaks | Config file at `~/.config/picoclaw-ddns/config.json` with `chmod 600` |
| Public IP APIs | Read-only, no auth needed, multiple fallback sources |
| Agent context | The SKILL.md never exposes real tokens — only the scripts read the config |
| Publishing | The skill folder contains **no** credentials or secrets |
The agent-triggering section gives only positive examples and no scope boundaries, so routine conversational requests about IPs may be interpreted as authorization to execute the skill. This is less severe than direct code injection, but it can still lead to unintended network calls and DNS modifications in response to ambiguous prompts.
No suspicious patterns detected.