Security audit
Security checks for vulnerabilities and agentic risk
The skill coherently helps agents create and manage free public hostnames, with expected but real exposure, credential, and dependency risks that users should handle deliberately.
Install only if you want an agent to manage public AgentDomains hostnames. Review the setup script first, understand that it may install upstream code and store an API key locally, keep `adom_...` keys out of logs and transcripts, and confirm before exposing a service, changing DNS, deleting names, delegating nameservers, or running the optional unpinned local MCP package.
The activation guidance is broad enough to encourage use whenever an agent needs a public hostname, webhook URL, or stable address, which can trigger external network exposure and account/domain operations in many workflows. Over-broad invocation increases the chance an agent will claim domains, expose services, or modify public DNS without sufficiently explicit user intent.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Get and manage a free public domain (yourname.makes.fyi or
yourname.agentdomains.co) for an AI agent or app using the AgentDomains CLI. Use
this whenever an agent builds a website or API and needs somewhere to put it, or
needs a public hostname to expose a server, create a webhook URL, or get a stable
address. Covers signup, claiming a name, pointing it at an IP or CNAME, getting
HTTPS, forwarding (HTTP redirect) to an existing site, reverse-proxying the name
to a backend over HTTPS, delegating to your own nameservers, removing a single DNS
The setup section directs execution of a shell script and installation of a Go package, then persists an API key to ~/.agentdomains/config.json, but does not clearly warn that this changes the system and stores credentials locally. In agent-driven environments, silent installation and credential persistence can violate least surprise and create credential exposure or persistence beyond the current task.
The skill recommends running npx -y agentdomains-mcp without pinning a specific version or integrity, which causes execution of whatever package version is current at invocation time. That creates a supply-chain risk: a compromised maintainer account, malicious publish, or unsafe update could result in arbitrary code execution in the agent environment.
The non-interactive usage section shows exporting API keys and passing authorization headers, but does not warn that these values are sensitive secrets that may leak through shell history, process listings, logs, transcripts, or shared environments. While common documentation practice, omitting handling guidance is risky in automated agent contexts where secrets may be surfaced unintentionally.
No suspicious patterns detected.