ClawHub
Back to skill

Security audit

Nex Domains

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent domain-management skill, but it needs review because it can probe arbitrary network targets, use Cloudflare credentials, and delete or export sensitive portfolio data with weak warnings.

Install only if you are comfortable with a CLI that stores a local domain portfolio, performs external DNS/WHOIS/HTTP/SSL checks, and can use a Cloudflare API token. Use a least-privilege Cloudflare token, avoid scanning internal or confidential hostnames, protect exports, and be careful with remove because it deletes local records without confirmation.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
lib/checkers.py:194
Finding

Unrestricted Domain Targets Enable Server-Side Request Forgery and Internal Network Probing

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
lib/storage.py:14
Finding

Portfolio Database and Log Permissions Depend on the Process Umask

Content
View full analysis
Remediation
View remediation

other

Note
Location
README.md:240
Finding

Local-Only Privacy Claim Omits Routine WHOIS, DNS, SSL, and HTTP Disclosures

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (26)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The added explanatory note states that MIT-0 removes the requirement to include the license notice in distributed derivative works, which is inaccurate and creates ambiguity about downstream compliance obligations. Misstating license terms can cause users to redistribute the software under incorrect assumptions, creating legal/compliance risk and supply-chain confusion even though it is not a code-execution issue.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 46)May include surrounding context.

text

This will:
1. Create a data directory at `~/.nex-domains/`
2. Initialize the SQLite database
3. Install the `nex-domains` CLI command
4. Check for required tools

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 56)May include surrounding context.

Ubuntu/Debian

bash
sudo apt install whois dnsutils openssl
bash setup.sh

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 70)May include surrounding context.

Ubuntu/Debian

bash
sudo apt install whois dnsutils openssl
bash setup.sh

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 71)May include surrounding context.

Ubuntu/Debian

bash
sudo apt install whois dnsutils openssl
bash setup.sh

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README instructs users to set Cloudflare API credentials and states that sync/API operations are supported, but it does not clearly warn that these credentials are sensitive secrets or that synchronization transmits portfolio and DNS data to an external service. In this skill's context, users are managing multi-domain infrastructure, so mishandling the token could expose or modify DNS across many domains.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README explicitly documents exporting the full domain portfolio without warning that the output may include sensitive client names, infrastructure metadata, DNS records, registrar relationships, and operational notes. In a domain-management context, those exports can materially aid reconnaissance or cause accidental data exposure if shared, backed up insecurely, or committed to source control.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill advertises and documents capabilities that read environment variables, perform shell execution, write local files, and access the network, but it does not declare an explicit tool scope such as permissions or allowed-tools. That mismatch can cause an agent to invoke the skill with broader authority than users expect, increasing the chance of unintended command execution, data export, or use of sensitive credentials like Cloudflare and TransIP tokens.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrase list includes generic terms such as "domain," "DNS," "SSL," "certificate," and "Cloudflare," which are common in many benign conversations and could cause the skill to activate outside the user's intended context. Because the skill can run shell commands, use network access, and touch local state, accidental invocation could lead to unexpected scans, API calls, or disclosure of locally stored portfolio data.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · lib/checkers.py (reported line 30)May include surrounding context.

python
def run_command(cmd: List[str], timeout: int = 10) -> Optional[str]:
    """Run a shell command safely and return output."""
    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

Dynamic Request Target

Medium
Category
Server-Side Request Forgery
Confidence
93% confidence
Finding

The code constructs an HTTPS request directly from a user-controlled domain string and performs a server-side request. If an attacker can supply arbitrary hostnames, they can cause the service to probe internal or sensitive network locations, enabling SSRF-style scanning or access depending on resolver behavior and deployment environment.

Content

Scanner excerpt · lib/checkers.py (reported line 206)May include surrounding context.

python
# Check HTTPS
    try:
        req = urllib.request.Request(f'https://{domain}', method='HEAD')
        with urllib.request.urlopen(req, timeout=API_TIMEOUT) as response:
            result['https_status'] = response.status
    except urllib.error.HTTPError as e:

Dynamic Request Target

Medium
Category
Server-Side Request Forgery
Confidence
93% confidence
Finding

This HTTP request also uses a user-controlled domain as the request target, creating the same SSRF risk over plain HTTP. In server or agent environments with network reachability to internal systems, this can be abused to map services or reach unintended endpoints.

Content

Scanner excerpt · lib/checkers.py (reported line 216)May include surrounding context.

python
# Check HTTP
    try:
        req = urllib.request.Request(f'http://{domain}', method='HEAD')
        with urllib.request.urlopen(req, timeout=API_TIMEOUT) as response:
            result['http_status'] = response.status
    except urllib.error.HTTPError as e:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

This code performs outbound network requests authenticated with a sensitive API token to enumerate Cloudflare zones, but the only nearby messaging is error logging and a missing-token warning. There is no confirmation prompt or user-facing disclosure in the code that the skill will access account data from Cloudflare using provided credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · lib/checkers.py (reported line 235)May include surrounding context.

python
try:
        req = urllib.request.Request(
            'https://api.cloudflare.com/client/v4/zones?per_page=100',
            headers={
                'Authorization': f'Bearer {api_token}',
                'Content-Type': 'application/json',

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · lib/checkers.py (reported line 266)May include surrounding context.

python
try:
        req = urllib.request.Request(
            'https://api.cloudflare.com/client/v4/zones?per_page=100',
            headers={
                'Authorization': f'Bearer {api_token}',
                'Content-Type': 'application/json',

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The function sends an authenticated HTTP request with a bearer token to retrieve DNS records, which is a safety-relevant network operation involving sensitive account context. The code lacks any confirmation prompt or user-facing notice describing that it will query external provider data using credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The function deletes a domain and, per its docstring, all related data, but the only disclosure is an internal logger message emitted after deletion. There is no confirmation prompt or user-directed warning in this file before the irreversible operation occurs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This function unconditionally deletes all existing DNS records for the domain before inserting the new set, which can cause irreversible data loss if the input is incomplete or wrong. The file contains no pre-action warning, confirmation, or explicit user disclosure beyond an internal log after completion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The remove command deletes a stored domain immediately after a name lookup, with no confirmation prompt, dry-run mode, or safeguard against accidental invocation. In a destructive CLI that manages a local portfolio database, this creates a realistic risk of accidental data loss from user mistakes, scripting errors, or agent misuse, especially because the action appears irreversible in this code path.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.sh (reported line 71)May include surrounding context.

sh
echo ""
    echo "  Install them with:"
    if [ "$PLATFORM" = "linux" ]; then
        echo "    Ubuntu/Debian: sudo apt install ${MISSING_TOOLS[*]}"
        echo "    RHEL/CentOS:   sudo yum install ${MISSING_TOOLS[*]}"
        echo "    Fedora:        sudo dnf install ${MISSING_TOOLS[*]}"
    elif [ "$PLATFORM" = "macos" ]; then

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.sh (reported line 72)May include surrounding context.

sh
echo ""
    echo "  Install them with:"
    if [ "$PLATFORM" = "linux" ]; then
        echo "    Ubuntu/Debian: sudo apt install ${MISSING_TOOLS[*]}"
        echo "    RHEL/CentOS:   sudo yum install ${MISSING_TOOLS[*]}"
        echo "    Fedora:        sudo dnf install ${MISSING_TOOLS[*]}"
    elif [ "$PLATFORM" = "macos" ]; then

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.sh (reported line 73)May include surrounding context.

sh
echo ""
    echo "  Install them with:"
    if [ "$PLATFORM" = "linux" ]; then
        echo "    Ubuntu/Debian: sudo apt install ${MISSING_TOOLS[*]}"
        echo "    RHEL/CentOS:   sudo yum install ${MISSING_TOOLS[*]}"
        echo "    Fedora:        sudo dnf install ${MISSING_TOOLS[*]}"
    elif [ "$PLATFORM" = "macos" ]; then

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · setup.sh (reported line 83)May include surrounding context.

sh
echo "  All required tools found."
fi

# Step 3: Create data directory
echo "[3/5] Creating data directory..."
mkdir -p "$DATA_DIR"
if [ "$PLATFORM" != "windows" ]; then

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.sh (reported line 87)May include surrounding context.

sh
echo "[3/5] Creating data directory..."
mkdir -p "$DATA_DIR"
if [ "$PLATFORM" != "windows" ]; then
    chmod 700 "$DATA_DIR"
fi
echo "  Data directory: $DATA_DIR"

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The examples include state-changing and data-producing actions like removing a domain and exporting portfolio data, but they do not explicitly instruct the agent to warn the user that local data will be deleted or written to disk. In practice this can cause accidental loss of tracked records or creation of sensitive export files containing client, registrar, and cost information without sufficiently informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.