ClawHub
Back to skill

Security audit

DNS配置基础版

Security checks for vulnerabilities and agentic risk

Overview

This skill is a basic DNS guidance and diagnostic helper; its command use is disclosed and limited to DNS lookup examples, with no evidence of hidden persistence or data exfiltration.

Before installing, treat this as a DNS diagnostic guide: allow dig-style lookup commands only for domains you intend to inspect, and review any suggested DNS record changes manually in your DNS provider console. The declared write tool is broader than the documented workflows need, so avoid using the skill for file or system changes unless you explicitly request them.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The skill declares exec and write capabilities but does not provide a clear warning about command execution or possible system/file changes. In an agent environment, this can normalize running shell commands and writing artifacts without sufficient user awareness, increasing the chance of unintended local actions or misuse when future prompts supply hostile inputs.

Static analysis

No suspicious patterns detected.