Security audit
Security checks for vulnerabilities and agentic risk
This skill is a DNS management helper, but its broad activation wording and under-scoped DNS mutation guidance mean users should review it before installation.
Install only if you intend to let an agent help with Volcengine DNS administration. Before using it, restrict it to DNS-specific requests, require explicit confirmation for create/update/delete operations, verify the target domain and record ID, and use a least-privilege Volcengine API key rather than a broad account key.
The description says the skill should be used when users need project management, task planning, progress tracking, or team collaboration, which are broad everyday scenarios and do not match the DNS-specific purpose. This makes the activation scope ambiguous and could cause unintended invocation outside the intended networking/DNS domain.
The summary fields end with fragments like 'Use when users' without any concrete trigger phrases or scope constraints. Because the activation condition is unfinished and unspecified, users and orchestrators cannot reliably distinguish when this skill should or should not activate.
The description says the skill is for Volcengine DNS record management, query, and update, but it also states it should be used for project management, task planning, progress tracking, and team collaboration. Those statements describe a different kind of skill and actively conflict with the DNS-focused functionality documented throughout the rest of the file.
The skill describes deletion of DNS records and notes irreversibility, but it does not present a prominent upfront safeguard, confirmation requirement, or restricted workflow in the overview/usage path. In an agent context, ambiguous destructive capability can lead to accidental service disruption, domain outage, or loss of critical routing records if the agent performs deletions without strong user confirmation.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import requests
url = "https://api.volcengine.com/dns/v1"
params = {
"recordType": "A"
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import requests
url = "https://api.volcengine.com/dns/v1"
params = {
"recordType": "A"
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import requests
url = "https://api.volcengine.com/dns/v1"
params = {
"recordType": "A"
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"ttl": 86400 }
response = requests.post(url, json=data) print(response.json())
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"ttl": 86400 }
response = requests.put(url, json=data) print(response.json())
No suspicious patterns detected.