DNS管理入门工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:24 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a Namecheap DNS helper, but it asks for high-impact DNS control while using overly broad activation wording and weak change-safety guidance.

Review this skill before installing. Only use it for explicit Namecheap DNS tasks, keep API credentials scoped and temporary where possible, list or export records before changes, and require confirmation before deleting records or changing nameservers.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:133

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

``` 2. Store dependencies in a version-controlled requirements file and require cryptographic hashes: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Generate the requirements file with hashes for the approved package and all transitive dependencies. 4. Use an explicitly trusted index and prevent unintended fallback to untrusted extra indexes: ```bash python3 -m pip install \ --index-url https://pypi.org/simple \ --require-hashes \ -r requirements.txt ``` 5. Install dependencies in an isolated virtual environment under an unprivileged account. Do not run the installation with `sudo` or administrator permissions. 6. Add automated dependency scanning and a controlled process for reviewing and updating pinned versions. 7. Keep Namecheap credentials out of the environment during dependency installation. Inject them only when the reviewed DNS-management implementation is executed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description includes broad triggers such as code generation, programming assistance, debugging, and deployment, which are much wider than DNS management. In an agent environment, that can cause the skill to activate in unrelated contexts and gain access to read/exec/write tooling, increasing the chance of unintended DNS changes or exposure of Namecheap credentials during unrelated workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation promotes creation, update, and deletion of DNS records without clearly warning that these actions can immediately break website routing, email delivery, verification records, or certificate issuance. In a tool meant for agent-assisted execution, omission of impact warnings and confirmation expectations makes destructive mistakes more likely, especially for small-site operators using live domains.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The capability coverage section lists vague, expansive keywords including generic development and automation phrases, making the skill eligible for activation far outside its intended DNS scope. Because the skill advertises exec/read/write tools and supports destructive operations, overbroad triggering raises the risk of accidental execution or unsafe tool selection in conversations unrelated to DNS administration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example shows a direct record delete command with no warning, backup guidance, or confirmation note, normalizing irreversible or service-disrupting changes. In practice, deleting the wrong DNS record can disable a site, break MX delivery, or remove TXT-based security controls such as SPF/verification records.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest and capability table state that the free version does not support DNS monitoring/propagation monitoring (L055, L245). However, the documented commands explicitly provide a propagate check operation, which is a monitoring/checking capability rather than basic record CRUD. This is a direct mismatch between the stated product scope and the documented behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

yaml

dns_config:
  api:
    base_url: "https://api.namecheap.com/xml.response"
    api_user: "${NAMECHEAP_API_USER}"
    api_key: "${NAMECHEAP_API_KEY}"
    username: "${NAMECHEAP_USERNAME}"

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Line L072 asserts that all keywords and use cases declared in the description are covered by the skill's capabilities. But the same document says some capabilities are not supported in the free edition, such as CAA and DNS monitoring/propagation monitoring (L053-L055, L245), creating an internal contradiction in the documentation about actual coverage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.