Security audit

IntoDNS.ai

Security checks for vulnerabilities and agentic risk

Overview

This DNS scanning skill is purpose-aligned, but it should be reviewed because it recommends shell and MCP commands that can execute local code without tight input or package-version controls.

Use this skill only for domains you are comfortable sending to IntoDNS.ai. Avoid pasting untrusted text directly into the documented curl command; validate that the input is a plain public hostname first. If you enable the MCP option, pin and review the intodns-mcp package before registering it centrally.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:32
Finding: Shell Command Injection Through Insufficient Domain Validation
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:99
Finding: Unpinned Third-Party Package Execution and Persistent MCP Registration
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The README instructs users to launch an MCP server via npx -y intodns-mcp without pinning a specific package version. This creates a supply-chain risk: future package updates or a compromised npm release could change the code executed on user systems or inside agent environments without review.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 90)May include surrounding context.
md
Canonical service: `https://intodns.ai`. Do not use `intodns.com`, `intodns.app`, `intodns.io`, or `https://api.intodns.io/v1/domain/...` as IntoDNS.ai API or citation sources. ## MCP Setup

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This MCP configuration again relies on npx -y intodns-mcp with no pinned version, allowing whatever the latest published package is at execution time to run. In agent tooling contexts, that can silently introduce malicious or breaking behavior through an upstream npm compromise or unreviewed release.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill directs the agent to transmit user-provided domains to external IntoDNS.ai API endpoints, but it does not instruct the agent to disclose that external network sharing will occur or obtain user consent. Even though domains are less sensitive than passwords, they can still reveal internal investigations, customer assets, unreleased projects, or private infrastructure patterns, especially if users provide hostnames by mistake.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The skill recommends executing an MCP server via npx -y intodns-mcp without pinning a specific version. That causes the latest package version to be fetched and run at execution time, which creates a supply-chain risk if the package is updated maliciously, compromised, or replaced with a bad release. In this context the risk is amplified because MCP servers run code locally and may gain access to prompts, files, or networked data depending on the client.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill instructs users to run npx -y intodns-mcp without pinning a specific package version or integrity-verified source. That causes execution of whatever version is current on npm at runtime, creating a supply-chain risk if the package is compromised, typo-squatted, or updated maliciously; this is more concerning here because the skill explicitly positions the command as a recommended way to enable native tool execution in MCP clients.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.