T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:187- Finding
Malformed SPF Template Can Disable Sender Authentication
- Content
View full analysis
- Remediation
View remediation
Security audit
DNS配置工具免费版
Security checks for vulnerabilities and agentic risk
Overview
This DNS helper is not malicious, but it needs Review because it is overbroad for a DNS guide and includes broken email-security examples that could misconfigure a domain.
Review carefully before installing. Use it only for narrow DNS lookup and planning help, verify all SPF/DKIM/DMARC records with an independent validator before publishing, and do not let the skill run unrelated code, deployment, messaging, file-write, or bulk automation tasks without explicit user confirmation.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:203- Finding
Malformed DMARC Template Can Leave a Domain Without an Enforceable Policy
- Content
View full analysis
- Remediation
View remediation
`. 2. Require the `v=DMARC1` tag to appear first and include a valid `p=` policy. 3. Begin with monitoring or quarantine as appropriate, review aggregate reports, and move to `p=reject` only after legitimate mail streams align correctly. 4. Ensure the reporting mailbox is controlled by the domain owner and protected against unwanted disclosure. 5. Validate the deployed record through authoritative DNS queries and a dedicated DMARC parser. 6. Add documentation tests that reject duplicate domain suffixes, missing mandatory tags, malformed quotation marks, and absent TXT record declarations. ]]>
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger conditions say the skill should be used for broad code generation, programming assistance, debugging, and deployment tasks, which far exceeds a DNS configuration scope. In an agent ecosystem, overbroad routing criteria can cause this skill to activate in many unrelated situations while it still has exec/read/write access, increasing the chance of unnecessary command execution or file modification.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill advertises itself as a DNS configuration helper, but its description also claims broad messaging, notification, communication integration, and even development/deployment applicability. This scope mismatch can cause the agent to invoke the skill in unrelated contexts and potentially grant execution or file-write behavior beyond what a user would reasonably expect from a DNS-only tool.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest description includes broad communication-workflow language unrelated to DNS, which can make the skill match common messaging or notification requests. That increases the chance the agent selects a tool with exec/write capabilities under false pretenses, creating an unnecessary expansion of operational scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description explicitly states "支持中文交互", and the feature summary repeats Chinese-only interaction language, but there is no indication that users may choose another language. This creates a locale/language constraint without opt-in or justification as a region-specific tool.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The functionality note lists "中文交互" as a core capability, which reinforces a fixed language expectation. Because no alternative language choice is offered elsewhere, this appears to impose a language policy rather than simply advertise support.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill describes create, modify, reset, import, export, save, and convert operations without clear warnings about persistence, side effects, or where data is written. In a skill that includes write and exec tooling, vague state-changing operations can mislead users into authorizing actions that alter files or saved outputs unexpectedly.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation states that the skill does not call external APIs and requires no API key, yet other sections describe HTTPS communication, cloud-service dependence, and API-related automation metrics. These contradictory claims can mislead users and orchestrators about the skill's network behavior, reducing trust boundaries and making unexpected external communication easier to hide.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The capability matrix clearly excludes CAA, Cloudflare proxy behavior, wildcard records, and bulk migration in the free version. Later generic sections on '核心功能执行', configuration import/export, and '全流程自动' present the skill as broadly capable without restating those exclusions, creating an intent mismatch within the documentation about actual supported scope.
- Content
Static analysis
No suspicious patterns detected.