NextDNS

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:06 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent read-first NextDNS diagnostic helper, but it can expose sensitive DNS activity and credentials through default command output and command-line usage.

Install only if you are comfortable giving the agent access to your NextDNS account data, including DNS logs that may reveal browsing activity. Prefer NEXTDNS_API_KEY from a protected environment over --api-key or inline examples, avoid running raw logs unless needed, and do not share transcripts or terminal output containing helper results.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/nextdns_helper.py:69

Finding

NextDNS API key may be exposed through command-line arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/nextdns_helper.py:69
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

python

parser.add_argument("--api-key", default=os.getenv("NEXTDNS_API_KEY"), help="NextDNS API key; defaults to NEXTDNS_API_KEY")

Technical Analysis

The helper permits users to provide the NextDNS API key through the --api-key command-line option. Command-line arguments can be recorded in shell history, process accounting, monitoring systems, diagnostic reports, or automation logs. Depending on the operating-system configuration, another local user may also be able to inspect the process argument vector while the helper is running.

The environment-variable default is safer than a command-line argument, but retaining the command-line option creates an avoidable credential-exposure path. The credential is otherwise handled appropriately: it is placed in the X-Api-Key header, is not included in the returned URL, and is transmitted only over HTTPS to the fixed official NextDNS API host.

Attack Path

1. A user invokes the helper with --api-key and a valid NextDNS credential.
2. The complete command is retained in shell history or exposed in process metadata while the helper runs.
3. A local user, monitoring service, support bundle, or log reader obtains the argument value.
4. The exposed key is used to authenticate directly to the NextDNS API.
5. The attacker can exercise whatever profile access and API permissions are associated with that key.

Impact Assessment

Exploitation requires access to shell history, process information, or command-execution logs. A recovered key may expose profile configuration, analytics, device information, and sensitive DNS activity for profiles authorized by the key. The helper does not grant additional system privileges, so the scope is bounded by the compromised API key's existing NextDNS permissions.

Remediation

View remediation

Remediation Suggestions

• Remove the --api-key option and accept the credential only through NEXTDNS_API_KEY or a protected credential store.
• If interactive use without an environment variable is required, obtain the key with getpass.getpass() so it is not echoed or stored in shell history.
• If backward compatibility requires retaining --api-key, display a clear warning that command-line secrets may be exposed and deprecate the option.
• Avoid including credentials in examples, execution logs, exception messages, or telemetry.
• Recommend narrowly scoped API credentials where the NextDNS platform supports them and rotate any credential suspected of exposure.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/nextdns_helper.py:40

Finding

Full request metadata and privacy-sensitive NextDNS responses are printed without redaction

Content

View full analysis

Vulnerability Details

File Location: scripts/nextdns_helper.py:40-58, 133
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

python

def request_json(method: str, path: str, api_key: str, params: dict[str, Any] | None = None) -> dict[str, Any]:
    query = ""
    if params:
        clean = {k: v for k, v in params.items() if v is not None}
        query = "?" + urllib.parse.urlencode(clean, doseq=True) if clean else ""
    url = f"{BASE_URL}{path}{query}"
    req = urllib.request.Request(url, method=method, headers={
        "X-Api-Key": api_key,
        "Accept": "application/json",
        "User-Agent": "openclaw-nextdns-helper/0.1",
    })
    try:
        with urllib.request.urlopen(req, timeout=20) as resp:
            raw = resp.read().decode("utf-8")
            return {"ok": True, "status": resp.status, "url": url, "response": json.loads(raw) if raw else None}
    except urllib.error.HTTPError as e:
        raw = e.read().decode("utf-8", errors="replace")
        try:
            body: Any = json.loads(raw)
        except Exception:
            body = raw
        return {"ok": False, "status": e.code, "url": url, "response": body}

python

print(json.dumps(result, indent=2, ensure_ascii=False))

Technical Analysis

The helper includes the complete request URL and complete decoded API response in its result and then prints that result to standard output. Request URLs can contain profile identifiers and sensitive query parameters such as device, search, cursor, and requested time ranges. API responses can contain full profile configuration, device information, analytics, queried domains, and detailed DNS logs.

This behavior conflicts with the Skill documentation's recommendation to summarize DNS activity minimally and avoid unnecessary disclosure of sensitive domains. Standard output is commonly retained in Agent transcripts ...[truncated 1742 chars]

Remediation

View remediation

Remediation Suggestions

• Make privacy-preserving summaries the default output for profile, analytics, and log commands.
• Require an explicit option such as --show-sensitive or --raw-output before printing complete API responses.
• Redact or omit sensitive URL parameters, including search, device, and cursor, from the displayed URL.
• Mask domain names, device identifiers, profile identifiers, client addresses, and other privacy-sensitive fields where full values are not necessary.
• Print only HTTP status and a sanitized endpoint identifier by default rather than the complete request URL.
• Document that complete output must not be placed in public issue reports, shared transcripts, or unprotected CI logs.
• Ensure HTTP error bodies pass through the same redaction policy because API errors can echo submitted values or sensitive response details.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

- NextDNS logs can reveal browsing/device activity. Summarize minimally and avoid pasting sensitive domains unless needed.
- API is marked beta by NextDNS; handle response changes defensively.
- Do not call destructive endpoints like `DELETE /profiles/:profile/logs` without explicit confirmation.
- Before config writes, export/read current profile and save a timestamped backup in the workspace or another user-approved location.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-summary.md (reported line 75)May include surrounding context.

md

- `raw=1` to include all DNS queries; default is deduped navigational A/AAAA/HTTPS plus noise filtering.

Streaming: `GET /profiles/:profile/logs/stream` is SSE. Use only when explicitly needed for live monitoring.
Download: `GET /profiles/:profile/logs/download`. Clear: `DELETE /profiles/:profile/logs`; destructive, ask first.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill explicitly instructs use of a Python helper that consumes environment variables and calls the NextDNS API, but it does not declare any tool scope or allowed-tools restrictions. This creates an authorization gap where a runtime may permit broader-than-intended env and network access, increasing the chance of secret exposure or unintended outbound API use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.