Technitium DNS

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:33 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent read-only Technitium DNS monitor, but it handles a sensitive API token in a way that can expose it over plaintext HTTP or redirects.

Install only if you can use a dedicated least-privilege Technitium token and an HTTPS endpoint you control. Avoid the documented http:// examples except for tightly controlled loopback use, and rotate any token that may have been sent over plaintext HTTP.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/technitium_health_check.py:29

Finding

Bearer Token Exposure Through Plaintext HTTP and Unrestricted Redirects

Content

View full analysis

Vulnerability Details

File Location: scripts/technitium_health_check.py:29-31; insecure HTTP configurations are also documented at SKILL.md:19-20 and SKILL.md:31-33
Vulnerability Type: Transmission of sensitive authentication credentials over an insufficiently protected network channel
Risk Level: High

Vulnerable Code

python

def api_get(base, token, path, params=None):
    qs = ('?' + urlencode(params)) if params else ''
    req = Request(base + path + qs, headers={'Authorization': 'Bearer ' + token})
    with urlopen(req, timeout=DEFAULT_TIMEOUT) as resp:
        body = resp.read().decode('utf-8', errors='replace')

The associated documentation explicitly permits a plaintext HTTP endpoint:

bash

export TECHNITIUM_URL="http://dns-server.example:5380"
export TECHNITIUM_TOKEN="..."

bash

TECHNITIUM_URL="http://dns-server.example:5380" \
TECHNITIUM_TOKEN="..." \
python3 /path/to/technitium-dns/scripts/technitium_health_check.py

Technical Analysis

The script obtains a sensitive API/session token from TECHNITIUM_TOKEN and places it in an HTTP Authorization: Bearer header. It then sends the request to the environment-controlled TECHNITIUM_URL without validating the URL scheme, destination origin, or redirect chain.

Because the documented examples use http://, users may transmit the bearer token without transport encryption. An attacker able to observe or modify traffic between the monitoring host and the Technitium server could capture the token directly or manipulate the HTTP exchange.

Python's urllib.request.urlopen follows supported redirects by default. The code does not disable redirects or independently verify that each redirect remains on the original trusted HTTPS origin. Consequently, a compromised or malicious endpoint can attempt to redirect authenticated requests toward an attacker-controlled destination.

Sending the token is necessary for ...[truncated 1898 chars]

Remediation

View remediation

Remediation Suggestions

1. Require https:// for all non-loopback Technitium endpoints and reject plaintext HTTP during configuration validation.
2. If local plaintext HTTP support is operationally necessary, require an explicit insecure opt-in and restrict it to loopback addresses such as 127.0.0.1 or ::1.
3. Disable automatic redirects for authenticated API requests, or implement a redirect handler that only permits redirects which remain on the exact original HTTPS scheme, host, and port.
4. Never forward the Authorization header when the destination origin changes.
5. Validate TECHNITIUM_URL using URL parsing before constructing requests; reject unexpected schemes, embedded credentials, fragments, and untrusted origins.
6. Update all documentation examples to use HTTPS and clearly warn that bearer tokens must not be sent over plaintext networks.
7. Replace the recommendation for non-expiring tokens with dedicated, least-privilege, revocable, and preferably time-limited monitoring tokens.
8. Ensure the monitoring account can access only the read-only endpoints required by the health check.
9. Support normal TLS certificate and hostname verification, and document how to deploy a trusted certificate rather than encouraging users to bypass verification.
10. Rotate any token that may previously have been transmitted over plaintext HTTP.

SkillSpector

Vulnerability Patterns

• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Tainted flow: 'req' from os.environ.get (line 28, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/technitium_health_check.py (reported line 29)May include surrounding context.

python

def api_get(base, token, path, params=None):
    qs = ('?' + urlencode(params)) if params else ''
    req = Request(base + path + qs, headers={'Authorization': 'Bearer ' + token})
    with urlopen(req, timeout=DEFAULT_TIMEOUT) as resp:
        body = resp.read().decode('utf-8', errors='replace')
    data = json.loads(body)
    if data.get('status') != 'ok':

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill requires environment variables containing a sensitive API token and performs network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization-boundary weakness: a host agent may expose env and network capabilities more broadly than intended, making it easier for the skill or future modifications to access secrets and external services without clear restriction.

Content

No source excerpt is available for this finding.