Security audit

AdGuard Home Manager

Security checks for vulnerabilities and agentic risk

Overview

This is a real AdGuard Home admin skill, but it gives an agent sensitive DNS visibility and network-wide mutation power with weak scoping and unsafe defaults users should review before installing.

Install only if you are comfortable giving the skill AdGuard Home credentials that can view DNS activity and change filtering for the whole network. Prefer HTTPS or a strictly local endpoint, use a dedicated least-privilege account if available, and review scripts/rules.sh before allowing agents to add or remove rules.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill description understates the scope of access by presenting a DNS blocking management tool while also exposing query-log inspection, which can reveal detailed network activity and browsing patterns for all users behind the resolver. This hidden breadth materially changes the privacy risk and could enable surveillance beyond what a user would reasonably expect from the stated description.

Context-Inappropriate Capability

High

Confidence: 91% confidence
Finding: Query-log access is broader than necessary for the stated purpose of managing AdGuard Home ad blocking, violating least-privilege expectations. Because DNS logs can expose internal device behavior, visited domains, and household or organizational activity patterns, inclusion of this capability significantly increases privacy and misuse risk.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The documented query-log capability exposes privacy-sensitive network activity without any explicit warning that it may reveal domains resolved by users and devices on the network. In the context of a home or small-office DNS server, this can disclose personal habits, services used, and other sensitive metadata even if content is not visible.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Rule changes and filtering toggles can alter DNS behavior for every client using the AdGuard Home instance, potentially causing outages, bypassing protections, or blocking legitimate services. Without an explicit warning, users may not appreciate that these actions have network-wide operational impact rather than affecting only their own session.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script reads administrative credentials from environment variables and sends them using Basic authentication to ADGUARD_BASE_URL, which defaults to plain HTTP. If the service is accessed over a network or through an untrusted path, credentials can be intercepted or replayed, leading to full compromise of AdGuard Home administration.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The script defaults to http://localhost:3000 and sends a Basic Authorization header, which transmits reusable credentials without transport encryption if the endpoint is not protected by another secure channel. Even though localhost reduces remote network exposure, skill context matters: users may override ADGUARD_BASE_URL to a non-local host, forward ports, or run this in containers/remote environments where plain HTTP can expose credentials to interception or misrouting.

Static analysis

No suspicious patterns detected.