域名DNS管理免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:28 AM UTC
• Version: 1.0.1

Overview

This DNS management skill is mostly coherent, but it can change live domain infrastructure and does not give enough guardrails for outage-prone changes or rollback.

Review every DNS and nameserver command before running it, export or record current DNS records first, and use provider tokens limited to the exact zone and operations needed. Prefer installing dependencies in an isolated environment with pinned versions, and do not rely on the skill's rollback wording because the free edition says rollback is not provided.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:236

Finding

Unpinned Python Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 236
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code

markdown

| cli4 | CLI tool | Required for Cloudflare operations | `pip install cloudflare-cli4` |

Technical Analysis

The skill instructs users or agents to install cloudflare-cli4 from the default Python package index without specifying an exact version, hash, or verified source. Consequently, the package content installed during a future skill execution may differ from the content available when the skill was audited.

This is a supply-chain weakness rather than evidence that the named package is currently malicious. If the package, one of its transitive dependencies, or its publishing account is compromised, the unpinned command could retrieve an attacker-controlled release. Python package installation may execute build-backend or setup logic, while the installed command will subsequently execute with the privileges of the invoking user.

Attack Path

1. An attacker compromises the package publisher, a transitive dependency, or the applicable package-distribution channel.
2. The attacker publishes a malicious release under the dependency name or introduces malicious behavior into a dependency selected during resolution.
3. A user or tool follows the documented command pip install cloudflare-cli4.
4. Because no version or integrity hash is enforced, pip resolves and installs the attacker-controlled release.
5. Malicious code can run during package installation or when the resulting cli4 command is invoked.
6. The malicious package operates with the invoking process's privileges and may access credentials available to that process, including the Cloudflare API-token environment variables documented by the skill.

Impact Assessment

Successful exploitation could allow arbitrary code execution under the account running pip ...[truncated 582 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a reviewed exact version, for example cloudflare-cli4==X.Y.Z.
• Use a lock file or requirements file containing cryptographic hashes, and install with hash verification, such as pip install --require-hashes -r requirements.txt.
• Record and verify the expected package publisher, source repository, release signature, and package hashes before recommending installation.
• Pin and review transitive dependencies rather than relying on unconstrained dependency resolution.
• Install the tool inside a dedicated virtual environment or isolated tool environment instead of the system Python environment.
• Never execute package installation with administrative privileges unless strictly necessary.
• Grant Cloudflare tokens only the minimum zone and operation permissions required, and avoid exposing unrelated secrets to the installation process.
• Add a documented dependency-update process that requires review, integrity verification, and security testing before changing pinned versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document states '可回滚：记录操作前状态，支持快速回退' as a core design principle, implying rollback support is part of the skill's behavior. Later, the same file lists '变更回滚机制' under known limitations for the free edition, directly contradicting the earlier claim about supported behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The '能力覆盖范围' line claims the skill is suitable for '项目管理、任务规划、进度跟踪、团队协作' and related scenarios, which contradicts the rest of the file describing only domain and DNS operations. This is not merely incomplete wording; it actively asserts intent for unrelated functions the skill does not implement or document elsewhere.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs users to perform nameserver and DNS changes that can disrupt email, web, and other services, yet it does not place an explicit warning immediately around those destructive steps. In an agent/automation context with exec enabled, users may run provider-changing commands without understanding outage risk or validating the target domain, increasing the chance of accidental service disruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The examples handle API tokens and operational commands that can modify external infrastructure, but they lack clear guidance to protect credentials, avoid leaking secrets into shell history/logs, and review commands before execution. In a skill with exec/write tools, that omission increases the risk of credential exposure and unintended provider-side changes.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.

md

| cli4 | CLI工具 | Cloudflare操作必需 | `pip install cloudflare-cli4` |
| dig | 系统命令 | 验证必需 | 安装bind-utils或dnsutils |
| curl | 系统命令 | 验证必需 | 系统自带 |
| jq | 系统命令 | 可选 | `sudo apt install jq` |

### API Key 配置
- **Cloudflare Token**：通过环境变量`CLOUDFLARE_API_TOKEN`或`CF_API_TOKEN`配置

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The skill metadata and body are primarily written in Chinese, with some English fragments, but there is no indication that users can choose their preferred language or locale. Under the policy, forcing a specific language without opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.