dotld

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:29 AM UTC
• Version: 1.0.1

Overview

This domain lookup skill is purpose-aligned, but it needs Review because it recommends an unverified remote installer and persists a Dynadot API key insecurely.

Review before installing. Prefer installing dotld from a pinned, verifiable release instead of running the documented curl-to-bash command, and avoid using --dynadot-key until the CLI stops auto-saving keys or stores them with restrictive permissions. Treat domain searches as third-party disclosures to Dynadot, especially for confidential brands or product names.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:27
• Finding: Unverified Mutable Remote Installer Is Piped Directly to Bash## Vulnerability Details **File Location**: `SKILL.md:27` **Vulnerability Type**: Remote payload retrieval and arbitrary shell execution **Risk Level**: Critical **Vulnerable Code Snippet**: ```bash curl -fsSL https://raw.githubusercontent.com/tedstonne/dotld/main/scripts/install.sh | bash ``` ### Technical Analysis The installation instruction retrieves a shell script from the mutable `main` branch of a personal GitHub repository and immediately executes the downloaded bytes with `bash`. It does not pin an immutable release or commit, validate a cryptographic checksum, verify a signature, or give the user an opportunity to inspect the script before execution. Consequently, the effective code executed during installation can differ from the code that existed when this Skill was reviewed. Compromise of the GitHub account or repository, a malicious repository update, or another supply-chain incident could turn this command into an arbitrary-code-execution channel. This behavior is not required for the Skill's declared domain availability functionality. The Skill only needs to invoke an installed `dotld` binary and make authorized Dynadot API requests. Automatically executing an unverified remote script exceeds that minimum requirement. ### Attack Path 1. An attacker compromises or otherwise gains write access to `tedstonne/dotld`, or a repository maintainer introduces malicious content into `scripts/install.sh` on the `main` branch. 2. The attacker modifies the installer to perform unauthorized actions, such as reading environment variables, copying credentials, modifying shell startup files, or downloading additional programs. 3. A user or Agent follows the installation instruction in `SKILL.md`. 4. `curl` downloads the current attacker-controlled script without integrity or authenticity verification. 5. The pipe passes the response directly to `bash`. 6. The malicious commands execute with all permissions of the user r ...[truncated 1015 chars]
• Remediation: ## Remediation Suggestions - Remove the `curl | bash` installation method. - Distribute `dotld` through a reputable package registry or a signed release channel and pin an explicit version. - If a standalone artifact is necessary, download it as a separate step from an immutable release URL. - Publish and verify a SHA-256 checksum before installing or executing the artifact. - Prefer cryptographic signature verification using a documented maintainer key. - Present the installer or its intended filesystem changes for inspection before execution. - Run installation with ordinary user privileges and document the exact files and directories it creates. - Prevent automatic installation by the Agent; require informed user confirmation when external software must be installed. - Pin any source reference to an immutable commit rather than the mutable `main` branch.

T09 · Insecure Skill Coding Practices

Error

• Location: references/cli-reference.md:67
• Finding: Dynadot API Key Is Automatically Persisted in a World-Readable Plaintext File## Vulnerability Details **File Location**: `references/cli-reference.md:67-75` **Additional Locations**: `references/cli-reference.md:22-24`, `references/cli-reference.md:42-48`, `SKILL.md:34-36` **Vulnerability Type**: Insecure secret handling and plaintext credential storage **Risk Level**: High **Vulnerable Documentation Snippets**: ```markdown ### `--dynadot-key <key>` Provide the Dynadot API key directly. When used, the key is auto-saved to the config file for future runs. ``` ```markdown When a key is provided via `--dynadot-key`, it is persisted to the config file automatically. ``` ```markdown Location: `~/.config/dotld/config.json` ```json { "dynadotKey": "your_api_key_here" } ``` Created automatically when `--dynadot-key` is used. The directory is created with `0755` permissions, the file with `0644`. ``` ### Technical Analysis The documented CLI accepts the Dynadot production API key as a command-line argument and automatically saves it in plaintext. Command-line secrets may be exposed through shell history, process inspection, diagnostic tooling, terminal logs, or audit systems. The persisted configuration file is documented as mode `0644`. On a conventional Unix-like system, this grants read access to the file owner, group members, and all other local users. Because the file directly contains `dynadotKey`, any local account capable of traversing the user's home and configuration paths may be able to retrieve the credential. The parent directory's documented `0755` permissions do not protect the secret from other local users. Automatically persisting the key also violates least-surprise and data-minimization principles. Domain availability queries require temporary access to the key, but they do not inherently require persistent plaintext storage or disclosure through process arguments. ### Attack Path A local disclosure path is as follows: 1. A user runs `dotld --dynado ...[truncated 1438 chars]
• Remediation: ## Remediation Suggestions - Do not automatically persist a key supplied through `--dynadot-key`; require an explicit, informed opt-in such as `--save-key`. - Avoid accepting secrets directly in command-line arguments. Prefer a protected environment variable, standard input, an interactive no-echo prompt, or an operating-system credential store. - If file-based storage is unavoidable, create `~/.config/dotld` with mode `0700` and `config.json` with mode `0600`. - Set a restrictive process umask before creation and use atomic creation that refuses to follow symbolic links or overwrite an unexpected file. - Validate existing ownership and permissions before reading or updating the configuration. - Warn users clearly that file-based credentials are stored in plaintext. - Provide commands to remove, rotate, and migrate saved credentials. - Recommend Dynadot-side least privilege and IP restrictions where supported. - Redact the key from logs, errors, telemetry, debug output, and process-launch diagnostics. - Update both `SKILL.md` and `references/cli-reference.md` so the documented key-handling behavior accurately reflects these protections.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Chaining Abuse

High

• Category: Tool Misuse

Content

If `dotld` is not already available on the machine, install it:

```bash
curl -fsSL https://raw.githubusercontent.com/tedstonne/dotld/main/scripts/install.sh | bash
```

## Prerequisites

• Confidence: 99% confidence
• Finding: The '| bash' construct removes any opportunity to inspect downloaded content before execution and turns a network fetch into immediate command execution. In the context of a skill document, this is more dangerous because it normalizes unsafe operator behavior and could lead an agent or user to run attacker-controlled code if the source is tampered with.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Storing an API key in a config file created with 0644 permissions makes it readable by other local users on multi-user systems. Because the file contains plaintext credentials, this can directly expose the Dynadot API key to unauthorized local accounts and any process running under them.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly states it queries the Dynadot API for real-time availability and pricing, but it does not clearly warn users that any queried domain ideas, brand names, or candidate domains will be transmitted to a third-party service. That creates a privacy and confidentiality risk, especially for unreleased product names, stealth brands, or valuable domain ideas that users may assume are being checked locally.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The CLI accepts a Dynadot API key on the command line and automatically persists it to disk for future runs, which expands the skill from a simple lookup tool into credential-handling software. In an agent context, this creates secret-retention risk because a transient credential supplied for one request may be stored without explicit user consent and remain accessible to later processes or users.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Automatically storing a supplied API key without an explicit warning or confirmation is a poor secret-handling practice. Users or calling agents may expect the key to be used only for the current invocation, so silent persistence can lead to unintended long-term credential exposure.

External Script Fetching

Low

• Category: Supply Chain

Content

If `dotld` is not already available on the machine, install it:

```bash
curl -fsSL https://raw.githubusercontent.com/tedstonne/dotld/main/scripts/install.sh | bash
```

## Prerequisites

• Confidence: 98% confidence
• Finding: The installation step fetches a remote script from GitHub and executes it directly with the shell. If the upstream repository, network path, or referenced script is compromised, arbitrary code will run on the host without review, making this a classic supply-chain and remote code execution risk.

Context-Inappropriate Capability

Low

• Confidence: 78% confidence
• Finding: The manifest frames the skill as a domain search tool, but this documentation adds a general local file-reading capability via --file. While useful for batch lookup, local file access is a broader capability than the description communicates and should be declared if available to the agent.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: The manifest only presents the skill as running the CLI to query Dynadot for pricing and availability. The documented behavior includes reading secrets from environment variables and local config files, which is a separate capability not justified by the narrow stated purpose unless explicitly declared.

Static analysis

No suspicious patterns detected.