Security audit

Octodns

Security checks for vulnerabilities and agentic risk

Overview

This DNS automation skill is purpose-aligned but needs Review because it can change live DNS and handles powerful credentials with weak safeguards.

Install only if you are comfortable reviewing and tightening the scripts first. Use least-privilege DNS tokens limited to test zones, avoid the webhook example as written, do a dry run before every apply, do not run automated --doit flows without approvals, and store provider credentials in a proper secrets manager or locked-down files with masked input and restrictive permissions.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (7)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/dynamic-dns.md:165
Finding: Unauthenticated webhook permits arbitrary DNS modification and path traversal
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/sync.sh:31
Finding: Unsafe command construction allows octoDNS argument injection
Content: View full analysis
&1) ``` ### Technical Analysis The script constructs an executable command as one scalar string and then expands it unquoted. Bash consequently performs word splitting and pathname expansion on the generated string. A config path or zone containing whitespace, wildcard characters, or option-like components can be interpreted as multiple octoDNS arguments rather than one value. This is not equivalent to evaluating arbitrary shell operators because expansion output is not reparsed as shell syntax. It nevertheless creates a concrete argument-injection boundary into a tool capable of changing live DNS. The parser also accesses `$2` without first verifying that a value exists for `--zone` or `--config`, allowing malformed invocations to fail unpredictably under `set -e`. ### Attack Path 1. An attacker or untrusted automation influences a `--zone` or `--config` value. 2. The value is concatenated into `CMD`. 3. `OUTPUT=$($CMD 2>&1)` expands ...[truncated 622 chars]
Remediation: View remediation
&1) EXIT_CODE=$? set -e ``` Additionally: - Verify that `--zone` and `--config` have following values before reading `$2`. - Reject zone names beginning with `-`. - Validate zones with strict DNS-name rules. - Resolve and constrain config paths to an approved directory. - Prefer a fixed, reviewed production configuration instead of accepting arbitrary paths during live apply operations. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/add-zone.sh:22
Finding: Unvalidated zone and provider values permit octoDNS YAML configuration injection
Content: View full analysis
> "$CONFIG_FILE" < "$TEMP_CONFIG" <
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/init_config.sh:10
Finding: Zone path traversal permits writing files outside the configuration directory
Content: View full analysis
" echo "Example: $0 example.com" exit 1 fi ZONE="$1" # Create config directory mkdir -p "$CONFIG_DIR" # Create zone file template ZONE_FILE="${CONFIG_DIR}/${ZONE}.yaml" if [ ! -f "$ZONE_FILE" ]; then cat > "$ZONE_FILE" <
Remediation: View remediation
&2 exit 1 ;; esac ``` - Prefer a robust DNS-name parser over shell patterns. - Resolve the parent directory and destination through a trusted language API and verify that the destination is a child of `CONFIG_DIR`. - Create files with exclusive semantics to avoid symlink or race-related replacement. - Refuse symlink destinations and inspect every parent component where the threat model includes other local users. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/lib/secure-creds.sh:5
Finding: Credential paths are embedded in Python source and secret-file permissions are not enforced
Content: View full analysis
/dev/null) ``` ```bash check_credential_file_permissions() { local file="$1" if [ ! -f "$file" ]; then echo "Error: Credential file not found: $file" >&2 return 1 fi if [ "$(uname)" = "Darwin" ]; then local perms=$(stat -f "%Lp" "$file") else local perms=$(stat -c "%a" "$file") fi if [ "$perms" != "600" ] && [ "$perms" != "400" ]; then echo "⚠️ Warning: $file has insecure permissions: $perms" >&2 echo " Recommended: chmod 600 $file" >&2 fi return 0 } ``` ```bash local creds_file="${creds_dir}/${provider}.json" # Check permissions before loading check_credential_file_permissions "$creds_file" # Load credentials based on provider if [ "$provider" = "easydns" ]; then export EASYDNS_TOKEN=$(python3 -c "import json; print(json.load(open('$creds_file'))['api_token'])" 2>/dev/null) export EASYDNS_API_KEY=$(python3 -c "import json; print(json.load(open('$creds_file'))['api_key'])" 2>/dev/null) export EASYDNS_PORTFOLIO=$(python3 -c "import json; print(json.load(open('$creds_file')).get('portfolio', ''))" 2>/dev/null) elif [ "$provider" = "route5 ...[truncated 2827 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/sync.sh:67
Finding: Destructive DNS deletion checks occur only after changes are applied
Content: View full analysis
&1) EXIT_CODE=$? # Display output echo "$OUTPUT" # Safety check: warn about deletes if echo "$OUTPUT" | grep -q "Delete <"; then echo "" echo "⚠️ WARNING: This sync will DELETE records!" echo "⚠️ Review the 'Delete' lines above carefully." if [ -n "$MODE" ]; then echo "⚠️ Run again with --doit to apply (currently in apply mode)" else echo "⚠️ This was a preview. Deletes will happen if you run with --doit" fi echo "" fi ``` The required behavior stated in `SAFETY.md:142-146` is: ```text 1. ALWAYS dump existing zones before making changes 2. Parse the preview output for Delete lines 3. Alert the user if deletes look suspicious 4. Require confirmation before applying changes with deletes 5. Log all changes for audit trail ``` ### Technical Analysis When `MODE` contains `--doit`, `octodns-sync` applies the desired state before its output is searched for deletion messages. The warning therefore cannot stop a destructive operation. The implementation does not force a preview, compare an approved preview to the apply operation, require confirmation, impose a deletion threshold, or create an audit log. This is particularly dangerous because octoDNS treats the YAML file as the complete desired state. Missing records may be deleted from the provider. ### Attack Path 1. A zone file is incomplete, stale, corrupted, or manipulated through another vulnerability. 2. A user or automated process invokes `sync.sh --doit`. 3. octoDNS computes and applies deletions. 4. Only after execution does the script search the output for `De ...[truncated 411 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/install.sh:12
Finding: Unpinned package installation creates a dependency supply-chain risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The description presents the skill as a broad DNS-as-code management utility supporting many providers and use cases such as syncing, deploying, bulk-updating, and migrating zones. The actual code shown only scaffolds initial octoDNS config for a single zone and a single provider target (easyDNS), plus a YAML provider source. It creates template files and prints guidance, but does not perform DNS synchronization, deployment, migration, or interaction with multiple providers. While this script is related to octoDNS setup, the behavior in the provided chunk is materially narrower than the declared purpose, especially regarding multi-provider support and active DNS operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description focuses on DNS zone management through octoDNS across multiple providers. However, this code chunk does not manage DNS zones, records, providers, synchronization, deployment, or migration. Its primary purpose is instead to verify security hygiene around credentials and configuration files for the skill. While this may be a supporting utility within a DNS-related project, the actual behavior of the provided code chunk is materially different from the declared purpose and introduces undeclared capabilities related to local security/config auditing.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/dynamic-dns.md (reported line 314)May include surrounding context.
scripts/sync.sh --zone example.com --doit else echo "Validation failed" rm config/example.com.yaml.tmp exit 1 fi

text

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises and instructs shell execution (scripts/install.sh, scripts/dump.sh, scripts/sync.sh) but does not declare any explicit tool scope or permissions boundary. In an agent setting, missing tool constraints can let the skill invoke shell actions without clear policy enforcement, which is risky here because the documented operations can modify live DNS state and cause destructive changes.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The webhook example exposes an HTTP endpoint that accepts untrusted JSON, writes to zone files, and then triggers live DNS synchronization. This turns documentation for DNS management into an unauthenticated remote control path for infrastructure changes, enabling unauthorized record modification, service hijacking, or denial of service if copied into real environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The webhook-triggered update flow describes accepting HTTP requests that directly modify DNS records and run a sync, but it omits any prominent warning about the sensitivity of these actions. In practice, users may deploy this pattern without access controls or change review, creating an easy path to unauthorized production DNS changes.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/dynamic-dns.md (reported line 203)May include surrounding context.
Trigger updates:

bash
curl -X POST http://localhost:5000/update \ -H "Content-Type: application/json" \ -d '{ "zone": "example.com",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The CI/CD example performs live production DNS changes using production credentials with --doit, but it does not prominently warn that the workflow applies real infrastructure modifications. This increases the risk of accidental outages or malicious changes if repository events, workflow edits, or credential handling are not tightly controlled.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/dynamic-dns.md (reported line 338)May include surrounding context.
echo "DNS sync failed:" >> "$LOG" echo "$sync_output" >> "$LOG" # Alert curl -X POST https://monitoring.example.com/alert
-d "DNS sync failed for example.com" fi

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The guide presents scripts/sync.sh --zone example.com --doit as the apply step without an explicit warning that this action can create, modify, or delete live DNS records. In a DNS migration context, destructive changes can cause outages, mail disruption, or service misrouting if the reviewed YAML or target state is incorrect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This shell script performs a file write by appending a new zone entry to production.yaml, which can affect production behavior. Although it prints progress messages, there is no confirmation prompt, cautionary comment, or user-facing warning that the command will modify a production config file.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/lib/secure-creds.sh (reported line 61)May include surrounding context.
sh
# Warn if permissions are too open (should be 600 or 400) if [ "$perms" != "600" ] && [ "$perms" != "400" ]; then echo "⚠️ Warning: $file has insecure permissions: $perms" >&2 echo " Recommended: chmod 600 $file" >&2 fi return 0

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/lib/secure-creds.sh (reported line 83)May include surrounding context.
sh
# Warn if permissions are too open (should be 600 or 400) if [ "$perms" != "600" ] && [ "$perms" != "400" ]; then echo "⚠️ Warning: $file has insecure permissions: $perms" >&2 echo " Recommended: chmod 600 $file" >&2 fi return 0

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/verify-security.sh (reported line 75)May include surrounding context.
sh
# Warn if permissions are too open (should be 600 or 400) if [ "$perms" != "600" ] && [ "$perms" != "400" ]; then echo "⚠️ Warning: $file has insecure permissions: $perms" >&2 echo " Recommended: chmod 600 $file" >&2 fi return 0

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest describes a DNS-management skill for managing and syncing zones with octoDNS, but this script implements a separate capability to read a local credentials file and export provider secrets into the environment. While provider authentication may be used operationally, exposing a dedicated credential-hydration helper is not described in the manifest's stated user-facing scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script exports API credentials into the process environment without warning, which increases the chance they will be exposed to child processes, debugging output, shell history workflows, or crash reports. In an automation/agent context, environment variables are a common propagation channel, so broadly exporting DNS credentials can unintentionally grant other invoked tools access to the same secrets.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The setup script collects DNS provider credentials and persists them in plaintext JSON files under a fixed local credentials directory. These secrets can be exposed through local compromise, backups, accidental sharing, or weak file permissions, and the skill context increases risk because DNS credentials can enable domain hijacking, traffic redirection, or outage-causing changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script writes sensitive API credentials to disk without any warning about plaintext storage or steps to protect the resulting file. In a DNS-management skill, exposed provider credentials are especially dangerous because they may allow an attacker to modify zone records, redirect traffic, obtain certificates, or disrupt service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The credential prompts use normal read calls, so the API token and key are echoed on the terminal and may be visible to shoulder surfers, screen recordings, terminal logs, or shared sessions. Because these are DNS provider secrets, disclosure can lead directly to unauthorized DNS changes and domain-level compromise.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The script is presented as agent configuration, but it also provisions and stores provider credentials, which is a broader and more sensitive behavior than the comment suggests. That mismatch can mislead reviewers or users and reduce scrutiny around secret handling, increasing the chance that sensitive operations are executed without informed consent.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: config/dump.yaml:9

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: config/example-production.yaml:13

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/migration.md:26

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/dump.sh:59

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/init_config.sh:36

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:139