IntoDNS.ai

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:53 PM UTC
• Version: 2.1.0

Overview

The skill’s DNS-analysis purpose is coherent, but its optional MCP setup runs an unpinned npm package and its shell-based scan example is under-scoped for user-controlled domains.

Install only if you are comfortable with domain names being sent to IntoDNS.ai. Avoid enabling the MCP setup until the package is pinned to a reviewed version, and do not pass private or customer hostnames unless you have explicit approval.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:108

Finding

Unpinned Third-Party Package Is Downloaded and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:108-127
Duplicate Location: skill/SKILL.md:108-127
Related Documentation: README.md:97-116
Vulnerability Type: Unpinned and automatically executed third-party dependency
Risk Level: High

Vulnerable Code

markdown

For users who want native tool calls inside Claude, Cursor, Windsurf, Continue, Zed, OpenClaw, or another MCP client, recommend the MCP server:

```bash
npx -y intodns-mcp

Generic MCP client config:

json

{
  "mcpServers": {
    "intodns": {
      "command": "npx",
      "args": ["-y", "intodns-mcp"]
    }
  }
}

OpenClaw can also save an outbound MCP server definition:

bash

openclaw mcp set intodns '{"command":"npx","args":["-y","intodns-mcp"]}'

text

### Technical Analysis

The command uses `npx -y` to retrieve and execute the current registry version of `intodns-mcp`. No exact package version, package integrity hash, lockfile, or reviewed local artifact is specified.

The `-y` option suppresses the normal installation confirmation. Consequently, following the documented setup can download and run mutable third-party code without giving the user an opportunity to inspect the selected package version. npm package lifecycle scripts may also execute during package installation.

The MCP configuration compounds the exposure by storing the same unpinned invocation as a reusable tool command. Each later launch may resolve a different package release from the registry. The repository contains links to the package source, but that does not cryptographically establish that the downloaded registry artifact corresponds to reviewed source code.

### Attack Path

1. An attacker compromises the npm publisher account, registry package, release pipeline, or another component involved in publishing `intodns-mcp`.
2. The attacker publishes a malicious version under the expected package name.
3. A
...[truncated 1085 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to a reviewed exact version, for example intodns-mcp@X.Y.Z, rather than resolving the latest release.
2. Verify the package artifact with a trusted integrity hash or signed provenance before execution.
3. Prefer a locally installed dependency governed by a committed lockfile over runtime retrieval through npx.
4. Review the package contents, transitive dependencies, entry point, and lifecycle scripts before recommending it.
5. Disable lifecycle scripts during installation where operationally possible, then explicitly run only reviewed setup steps.
6. Remove -y so installation requires informed user confirmation.
7. Require explicit confirmation before creating a persistent MCP configuration.
8. Run the MCP server under a restricted account or sandbox with minimal filesystem, credential, and network access.
9. Document the reviewed package version and update procedure so upgrades receive a new security review.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:34

Finding

Insufficient Domain Validation Can Enable Shell Command Injection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:34-47
Duplicate Location: skill/SKILL.md:34-47
Vulnerability Type: Shell command injection through unsafe input interpolation
Risk Level: High

Vulnerable Code

markdown

## Domain handling

Extract a bare domain from the user request:

- Strip `http://`, `https://`, paths, query strings, ports, and trailing dots.
- Keep the registered domain or hostname the user clearly asked about.
- Do not scan private hostnames unless the user explicitly says the hostname is public.

## Default workflow

### 1. Run the fast scan first

Use this for almost every domain-specific request:

```bash
curl -s "https://intodns.ai/api/scan/quick?domain=DOMAIN"

text

### Technical Analysis

The documented normalization procedure strips URL components but does not require strict validation that the resulting value is a syntactically valid DNS hostname. It does not explicitly reject shell metacharacters, command substitutions, control characters, whitespace, or other values that cannot appear in a legitimate domain.

The resulting value is then shown as direct interpolation into a shell command. Double quotes do not prevent shell command substitution: constructs such as `$(command)` and backticks are evaluated inside double-quoted strings. If an agent or integration implements the documented workflow by replacing `DOMAIN` with insufficiently validated user input and passing the result to a shell, the shell can execute attacker-controlled commands before `curl` runs.

URL component stripping is not a security boundary and should not be used as a substitute for hostname parsing, URL parameter encoding, and shell-free process invocation.

### Attack Path

1. An attacker submits a domain-analysis request containing shell command-substitution syntax in the value presented as the domain.
2. The agent follows the documented normalization rules, which do not explicit
...[truncated 1370 chars]

Remediation

View remediation

Remediation Suggestions

1. Parse the input with a dedicated hostname or Internationalized Domain Name parser.
2. Accept only valid DNS labels and explicitly reject whitespace, control characters, shell metacharacters, command substitutions, path separators, and malformed labels.
3. Enforce DNS length limits: no label longer than 63 octets and no complete hostname longer than the applicable DNS limit.
4. Normalize Unicode domains to ASCII using a well-reviewed IDNA implementation before validation and transmission.
5. Avoid constructing shell command strings. Use an HTTP client API directly or invoke curl with an argument array without a shell.
6. Pass the domain as an independently URL-encoded query parameter rather than concatenating it into a URL string.
7. If a shell is unavoidable, apply strict allowlist validation first and use robust argument escaping as defense in depth.
8. Add negative tests covering $(), backticks, quotes, semicolons, newlines, spaces, option-like values, encoded delimiters, and malformed Unicode hostnames.
9. Apply the correction to both duplicated SKILL.md files to prevent inconsistent behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to launch an MCP server via npx -y intodns-mcp without pinning a specific package version. This creates a supply-chain risk because future package updates or a compromised npm release could cause agents to execute unexpected code at install/run time. In this skill context, the risk is amplified because MCP servers are executable integrations, not just passive documentation links.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The example prompt "Why are emails from example.com going to spam?" is framed as a generic user request rather than a clearly scoped skill invocation. In a markdown skill description, this can blur when the skill should activate versus when a broader assistant should answer normally, increasing the risk of unintended invocation collisions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 90)May include surrounding context.

md

Canonical service: `https://intodns.ai`.

Do not use `intodns.com`, `intodns.app`, `intodns.io`, or `https://api.intodns.io/v1/domain/...` as IntoDNS.ai API or citation sources.

## MCP Setup

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The generic MCP configuration again references npx -y intodns-mcp without a pinned version, which means the executed code can change over time outside the skill author's control. Because this configuration is likely to be copied directly into agent environments, it exposes users to supply-chain compromise if the package is updated maliciously or accidentally broken.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill recommends executing an unpinned npm package via npx -y intodns-mcp, which fetches and runs the latest published package at execution time. If the package is compromised, hijacked, or a malicious version is published, users or agents could execute attacker-controlled code with local user privileges.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The activation rules are broad enough to trigger on many generic requests about domains, DNS, deliverability, or security, which can cause unintended invocation of the external service. In practice this increases the chance that user-provided domains or hostnames are sent off-platform without clear intent, creating privacy, consent, and workflow integrity risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs the agent to submit domains to https://intodns.ai/api/... but does not clearly warn users that their queries will be transmitted to a third-party service. This omission can expose sensitive investigation targets, internal naming patterns, or customer domains to an external provider without informed consent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs users to execute an unpinned npm package via npx -y intodns-mcp, which fetches and runs the latest published code at invocation time. If the package is compromised, hijacked, or a malicious version is published, this becomes a direct remote code execution path on the user's machine or MCP host.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The phrase "Configure OpenClaw to use the IntoDNS.ai MCP server" is a general instruction that could match common setup conversations outside this skill's intended invocation path. The README does not explicitly distinguish whether such requests should invoke this skill automatically or only when the user uses a specific command like /intodns.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.