ClawHub
Back to skill

Security audit

dotld

Security checks for vulnerabilities and agentic risk

Overview

This domain lookup skill is purpose-aligned, but it needs Review because it recommends an unverified remote installer and persists a Dynadot API key insecurely.

Review before installing. Prefer installing dotld from a pinned, verifiable release instead of running the documented curl-to-bash command, and avoid using --dynadot-key until the CLI stops auto-saving keys or stores them with restrictive permissions. Treat domain searches as third-party disclosures to Dynadot, especially for confidential brands or product names.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:27
Finding

Unverified Mutable Remote Installer Is Piped Directly to Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:27
Vulnerability Type: Remote payload retrieval and arbitrary shell execution
Risk Level: Critical

Vulnerable Code Snippet:

bash
curl -fsSL https://raw.githubusercontent.com/tedstonne/dotld/main/scripts/install.sh | bash

Technical Analysis

The installation instruction retrieves a shell script from the mutable main branch of a personal GitHub repository and immediately executes the downloaded bytes with bash. It does not pin an immutable release or commit, validate a cryptographic checksum, verify a signature, or give the user an opportunity to inspect the script before execution.

Consequently, the effective code executed during installation can differ from the code that existed when this Skill was reviewed. Compromise of the GitHub account or repository, a malicious repository update, or another supply-chain incident could turn this command into an arbitrary-code-execution channel.

This behavior is not required for the Skill's declared domain availability functionality. The Skill only needs to invoke an installed dotld binary and make authorized Dynadot API requests. Automatically executing an unverified remote script exceeds that minimum requirement.

Attack Path

  1. An attacker compromises or otherwise gains write access to tedstonne/dotld, or a repository maintainer introduces malicious content into scripts/install.sh on the main branch.
  2. The attacker modifies the installer to perform unauthorized actions, such as reading environment variables, copying credentials, modifying shell startup files, or downloading additional programs.
  3. A user or Agent follows the installation instruction in SKILL.md.
  4. curl downloads the current attacker-controlled script without integrity or authenticity verification.
  5. The pipe passes the response directly to bash.
  6. The malicious commands execute with all permissions of the user r ...[truncated 1015 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash installation method.
  • Distribute dotld through a reputable package registry or a signed release channel and pin an explicit version.
  • If a standalone artifact is necessary, download it as a separate step from an immutable release URL.
  • Publish and verify a SHA-256 checksum before installing or executing the artifact.
  • Prefer cryptographic signature verification using a documented maintainer key.
  • Present the installer or its intended filesystem changes for inspection before execution.
  • Run installation with ordinary user privileges and document the exact files and directories it creates.
  • Prevent automatic installation by the Agent; require informed user confirmation when external software must be installed.
  • Pin any source reference to an immutable commit rather than the mutable main branch.

T09 · Insecure Skill Coding Practices

Error
Location
references/cli-reference.md:67
Finding

Dynadot API Key Is Automatically Persisted in a World-Readable Plaintext File

Content
View full analysis

Vulnerability Details

File Location: references/cli-reference.md:67-75
Additional Locations: references/cli-reference.md:22-24, references/cli-reference.md:42-48, SKILL.md:34-36
Vulnerability Type: Insecure secret handling and plaintext credential storage
Risk Level: High

Vulnerable Documentation Snippets:

markdown
### `--dynadot-key <key>`

Provide the Dynadot API key directly. When used, the key is auto-saved to the config file for future runs.
markdown
When a key is provided via `--dynadot-key`, it is persisted to the config file automatically.
markdown
Location: `~/.config/dotld/config.json`

```json
{
  "dynadotKey": "your_api_key_here"
}

Created automatically when --dynadot-key is used. The directory is created with 0755 permissions, the file with 0644.

text

### Technical Analysis

The documented CLI accepts the Dynadot production API key as a command-line argument and automatically saves it in plaintext. Command-line secrets may be exposed through shell history, process inspection, diagnostic tooling, terminal logs, or audit systems.

The persisted configuration file is documented as mode `0644`. On a conventional Unix-like system, this grants read access to the file owner, group members, and all other local users. Because the file directly contains `dynadotKey`, any local account capable of traversing the user's home and configuration paths may be able to retrieve the credential. The parent directory's documented `0755` permissions do not protect the secret from other local users.

Automatically persisting the key also violates least-surprise and data-minimization principles. Domain availability queries require temporary access to the key, but they do not inherently require persistent plaintext storage or disclosure through process arguments.

### Attack Path

A local disclosure path is as follows:

1. A user runs `dotld --dynado
...[truncated 1438 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not automatically persist a key supplied through --dynadot-key; require an explicit, informed opt-in such as --save-key.
  • Avoid accepting secrets directly in command-line arguments. Prefer a protected environment variable, standard input, an interactive no-echo prompt, or an operating-system credential store.
  • If file-based storage is unavoidable, create ~/.config/dotld with mode 0700 and config.json with mode 0600.
  • Set a restrictive process umask before creation and use atomic creation that refuses to follow symbolic links or overwrite an unexpected file.
  • Validate existing ownership and permissions before reading or updating the configuration.
  • Warn users clearly that file-based credentials are stored in plaintext.
  • Provide commands to remove, rotate, and migrate saved credentials.
  • Recommend Dynadot-side least privilege and IP restrictions where supported.
  • Redact the key from logs, errors, telemetry, debug output, and process-launch diagnostics.
  • Update both SKILL.md and references/cli-reference.md so the documented key-handling behavior accurately reflects these protections.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The '| bash' construct removes any opportunity to inspect downloaded content before execution and turns a network fetch into immediate command execution. In the context of a skill document, this is more dangerous because it normalizes unsafe operator behavior and could lead an agent or user to run attacker-controlled code if the source is tampered with.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

If dotld is not already available on the machine, install it:

bash
curl -fsSL https://raw.githubusercontent.com/tedstonne/dotld/main/scripts/install.sh | bash

Prerequisites

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Storing an API key in a config file created with 0644 permissions makes it readable by other local users on multi-user systems. Because the file contains plaintext credentials, this can directly expose the Dynadot API key to unauthorized local accounts and any process running under them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly states it queries the Dynadot API for real-time availability and pricing, but it does not clearly warn users that any queried domain ideas, brand names, or candidate domains will be transmitted to a third-party service. That creates a privacy and confidentiality risk, especially for unreleased product names, stealth brands, or valuable domain ideas that users may assume are being checked locally.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The CLI accepts a Dynadot API key on the command line and automatically persists it to disk for future runs, which expands the skill from a simple lookup tool into credential-handling software. In an agent context, this creates secret-retention risk because a transient credential supplied for one request may be stored without explicit user consent and remain accessible to later processes or users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Automatically storing a supplied API key without an explicit warning or confirmation is a poor secret-handling practice. Users or calling agents may expect the key to be used only for the current invocation, so silent persistence can lead to unintended long-term credential exposure.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The installation step fetches a remote script from GitHub and executes it directly with the shell. If the upstream repository, network path, or referenced script is compromised, arbitrary code will run on the host without review, making this a classic supply-chain and remote code execution risk.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

If dotld is not already available on the machine, install it:

bash
curl -fsSL https://raw.githubusercontent.com/tedstonne/dotld/main/scripts/install.sh | bash

Prerequisites

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The manifest frames the skill as a domain search tool, but this documentation adds a general local file-reading capability via --file. While useful for batch lookup, local file access is a broader capability than the description communicates and should be declared if available to the agent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The manifest only presents the skill as running the CLI to query Dynadot for pricing and availability. The documented behavior includes reading secrets from environment variables and local config files, which is a separate capability not justified by the narrow stated purpose unless explicitly declared.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.