Security audit

Octodns

Security checks across malware telemetry and agentic risk

Overview

This DNS automation skill is mostly coherent, but it needs review because it handles high-value DNS credentials and live DNS changes with hard-coded credential paths and some unsafe examples.

Review or patch the credential handling before installing: replace the hard-coded /Users/markjr path with a user-controlled or secret-manager location, set credential files to 600 permissions, and use least-privilege DNS API tokens. Treat --doit as production-impacting, always run a dry-run first, and do not deploy the webhook or CI examples without authentication, validation, approvals, and protected secrets.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The documented behavior materially understates the skill's real operational scope: it appears to manage credentials, inspect local files, and rely on hard-coded local credential paths while claiming broad provider support. This mismatch is dangerous because users may grant trust or run the skill expecting generic DNS automation, but the underlying implementation could access sensitive local credential material or behave unpredictably across environments, increasing the chance of credential exposure, accidental misconfiguration, or unintended DNS changes.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The webhook example exposes a network-reachable endpoint that accepts user-supplied DNS parameters, writes directly to zone files, and then performs a live sync. This creates an externally triggered infrastructure-change path with no authentication, authorization, input validation, or rate limiting, so an attacker could modify DNS records and redirect traffic or disrupt services.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The script reads DNS provider credentials from a hard-coded, user-specific path and exports them into the environment. While loading credentials is relevant to DNS management, embedding a specific local path tied to one user's home directory is unsafe because it assumes access to sensitive local material and can cause unintended secret exposure or misuse when the skill runs on another system or under automation.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The script stores DNS provider credentials in a hard-coded absolute path under a specific user's home directory outside the skill workspace. This creates an unjustified secret storage location, can leak credentials across projects or users, and may write sensitive data to an unexpected filesystem path where access controls and lifecycle management are unclear.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The webhook-triggered update flow performs system-impacting actions—modifying DNS configuration and pushing live changes—without warning users that the example is unsafe to expose as written. Because DNS controls traffic routing and service reachability, presenting this pattern without safeguards materially increases the chance of accidental insecure deployment.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The CI/CD example uses high-value DNS provider secrets to apply changes to production but does not emphasize the sensitivity of those credentials or the blast radius of automatic syncs. In practice, weak secret handling or unreviewed workflow triggers could let attackers or mistakes push unauthorized DNS changes affecting availability and traffic integrity.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The guide instructs users to run `scripts/sync.sh --zone example.com --doit` to apply live DNS changes, but it does not explicitly warn that this can immediately create, modify, or delete production records and potentially cause outages if the plan was misreviewed. In a DNS migration context, such changes are inherently high-risk operational actions, so omitting a clear confirmation checkpoint or rollback caution can lead to accidental service disruption.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The setup flow prompts for API secrets and writes them directly to a JSON file on disk without warning the user that sensitive credentials will be stored locally. It also does not set restrictive file permissions, increasing the risk that other local users, backup systems, or unrelated tooling may read and expose DNS API credentials that could allow zone modification or takeover.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script constructs a shell command as a single string and then executes it via command substitution, allowing shell metacharacters embedded in user-controlled inputs such as --config or --zone to be interpreted by the shell. Because this skill is intended to manage production DNS and can run in apply mode with loaded provider credentials, successful command injection could lead to arbitrary code execution and compromise of DNS infrastructure or secrets.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: config/dump.yaml:9

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: config/example-production.yaml:13

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/migration.md:26

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/dump.sh:59

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/init_config.sh:36

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:139