ClawHub
Back to skill

Security audit

DNS查询工具

Security checks for vulnerabilities and agentic risk

Overview

The skill is framed as a DNS lookup tool but requests broad read, write, and command-execution access and advertises unrelated automation capabilities.

Review this skill before installing. It may be usable for DNS lookups, but only in an agent environment that constrains command execution to dig and prevents unrelated file reads, file writes, API calls, or shell commands. The artifact should be narrowed to DNS-only inputs and permissions before general use.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:23
Finding

Overprivileged Tool Access for a DNS Lookup Skill

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-26
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: Medium

Relevant capability declarations (SKILL.md, lines 23-26):

yaml
tools:
- read
- exec
- write

Related functionality advertised elsewhere (SKILL.md, lines 162-166):

markdown
## 主要功能
- **自动化执行**: 用bind-utils的dig把主机名解析为IP,排查域名。Resolve hostnames to IP addres
- **文件处理**: 支持多种文件格式的读取、解析和写入操作
- **API集成**: 通过标准化接口调用外部服务并处理响应
- **命令执行**: 在安全沙箱中执行系统命令并收集结果

Technical Analysis

The Skill's stated purpose is resolving hostnames through dig. That task does not require unrestricted filesystem write access, and it ordinarily does not require general filesystem read access. If command execution is necessary, it should be narrowly limited to a fixed dig executable and validated DNS arguments.

Instead, the manifest requests generic read, write, and exec tools. The document also advertises broad file processing, external API integration, and system-command execution. No command allowlist, filesystem boundary, network destination restriction, shell-metacharacter filtering, hostname validation, or approval requirement is specified.

The input model accepts a free-form instruction:

markdown
| instruction | string | 是 | 用户指令文本 |

Because no implementation files exist, this audit cannot confirm that arbitrary commands or filesystem operations are actually executed. The confirmed issue is the excessive capability declaration and unsafe authorization design, not a demonstrated command-injection payload.

Attack Path

  1. An operator installs or invokes the Skill expecting only DNS resolution.
  2. The hosting Agent grants the declared read, write, and exec capabilities.
  3. An attacker or untrusted user supplies a crafted free-form instruction.
  4. If the Agent interprets that instruction using the ...[truncated 1046 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the read and write tools because they are not necessary for hostname resolution.
  2. Prefer a dedicated DNS-resolution API over general command execution.
  3. If exec must remain available, enforce an executable allowlist containing only the absolute path to dig.
  4. Pass arguments directly to the process API without invoking a shell.
  5. Validate hostnames using a strict DNS-name parser and permit only an explicit allowlist of record types.
  6. Reject shell metacharacters, option injection, arbitrary resolver addresses, and unsupported dig flags.
  7. Apply query-count, timeout, output-size, and concurrency limits.
  8. Restrict outbound network access to approved DNS resolvers where operationally feasible.
  9. Require explicit user approval for any operation outside a DNS query.
  10. Align the documentation with the Skill's actual purpose by removing claims of generic file processing, API integration, and command execution.
  11. Add tests confirming that crafted instructions cannot trigger filesystem access or commands other than the approved DNS operation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation guidance includes broad, unrelated business and marketing scenarios instead of narrowly scoped DNS troubleshooting use cases. This ambiguity increases the chance that the skill will be invoked in contexts where its exec-capable tooling can be misapplied, especially because the skill already claims unrelated automation features.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Declaring read, write, and exec tools for a simple DNS lookup skill violates least privilege. If the agent invokes this skill assuming it only resolves hostnames, the excess permissions could be abused to modify files or execute arbitrary commands, increasing the blast radius well beyond DNS resolution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill is presented as a DNS lookup tool, but the documentation expands its scope to generic file processing, API integration, information retrieval, and command execution. This scope mismatch is dangerous because an agent or user may grant the skill broader authority than expected, enabling unintended filesystem or shell actions under the cover of a benign networking utility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The markdown advertises file processing, API integration, and command execution but does not clearly warn users that these actions may access the filesystem, call external services, or run shell commands. In a skill framed as a simple DNS tool, this hidden operational breadth can cause users or orchestrators to approve actions without understanding their true security impact.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The description says '支持中文交互' as a default behavior, which can be interpreted as enforcing a specific language preference. Because no alternative language choice or opt-in is offered in the natural-language instructions, this may conflict with language/locale choice expectations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill is documented as a DNS lookup tool, but the input schema uses generic fields like instruction and context, and the example output says lookup 相关配置参数 rather than a hostname, record type, or resolved IP data. This documentation does not merely omit details; it conflicts with the specific DNS-query intent described elsewhere.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.