name.com registrar

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:28 PM UTC
• Version: 0.0.14

Overview

This skill has a coherent domain-management purpose, but it installs an unpinned npm server that would receive powerful Name.com registrar credentials.

Review and pin the exact namecom-clawbot version before installing, prefer sandbox credentials first, use Name.com IP whitelisting, and avoid exposing production registrar credentials to this MCP server unless you accept the DNS, domain-transfer, and purchase risks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned Third-Party npm Package Installed with Registrar Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"openclaw": {"requires": {"bins": ["node", "npm"], "env": ["NAMECOM_USERNAME", "NAMECOM_TOKEN"], "envOptional": ["NAMECOM_USERNAME_TEST", "NAMECOM_TOKEN_TEST"]}, "primaryEnv": "NAMECOM_TOKEN", "homepage": "https://github.com/patramsey/namecom-clawbot", "install": [{"id": "node", "kind": "node", "package": "namecom-clawbot", "bins": ["namecom-clawbot"], "label": "Install namecom-clawbot MCP server (npm)"}]}}

Technical Analysis

The installation metadata identifies namecom-clawbot only by its npm package name. It does not pin an exact audited version or specify an integrity hash. Consequently, installation can resolve to a future package release whose contents differ from those reviewed during this audit.

The package is intended to execute with access to NAMECOM_USERNAME and NAMECOM_TOKEN. According to the skill documentation, the Name.com token does not support per-operation scopes and can perform sensitive registrar and DNS operations. Although SKILL.md states that the package uses signed npm provenance, provenance establishes a relationship with a build source; it does not guarantee that every future source change or release is trustworthy. The executable package source was not included in the audited project, so its implementation and the documented purchase-confirmation gate could not be independently verified.

This is a supply-chain exposure rather than evidence that the currently published package is malicious.

Attack Path

1. An attacker compromises the npm publisher account, release workflow, source repository, or another component used to publish namecom-clawbot.
2. The attacker publishes a malicious release under the same npm package name.
3. A user or automated host installs the dependency without an exact version and ...[truncated 1463 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin namecom-clawbot to an exact version that has been reviewed, rather than allowing npm to resolve an unspecified release.
2. Enforce the expected package integrity digest through a lockfile or equivalent verified installation mechanism.
3. Vendor or otherwise retain the reviewed executable source so the deployed implementation can be compared with the audited version.
4. Verify npm provenance, release signatures, repository tags, and build workflow identity before installation; do not treat provenance alone as a security review.
5. Pin and audit transitive dependencies and use reproducible, immutable builds.
6. Run the MCP server as a dedicated, unprivileged operating-system user inside a container or similarly isolated environment.
7. Expose only the required Name.com credentials to the process and prevent access to unrelated environment variables, files, and host services.
8. Apply Name.com API IP whitelisting and use sandbox credentials during validation.
9. Prefer limited account credit or a payment method with spending limits and alerts to reduce financial exposure.
10. Independently inspect and test the package implementation, particularly the claimed purchase-token gate, before enabling production credentials.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.