Security audit

Volcengine Network Dns

Security checks for vulnerabilities and agentic risk

Overview

This DNS management skill is not clearly scoped and could guide an agent toward infrastructure-changing operations with broad command authority and weak safeguards.

Review this skill carefully before installing. It may be useful for Volcengine DNS work, but only use it with tightly scoped credentials, explicit human confirmation for create/update/delete operations, and clear domain or zone identifiers. Avoid giving it broad shell access or generic API keys until the publisher clarifies the credential boundary and removes unrelated activation language.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The skill metadata and description are internally inconsistent, describing both DNS management and unrelated project-management/task-planning use cases. This can cause an agent or user to invoke the skill in the wrong context, reducing trust and increasing the chance of unsafe or unintended operations against infrastructure. In a skill that can modify DNS, ambiguity is security-relevant because mistaken activation can lead to service disruption.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The skill declares an LLM `API_KEY` dependency even though the stated purpose is DNS record management, creating confusion about what external services are actually required and where sensitive credentials may be sent. This mismatch can lead operators to provision unnecessary secrets or route infrastructure-related data to an unintended third-party model endpoint. Because the skill also exposes `exec`, unclear secret and service boundaries increase operational risk.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: Overly broad and inconsistent activation guidance makes it unclear when the skill should be invoked, increasing the likelihood that an agent will select it for unrelated requests. In a skill capable of infrastructure administration, erroneous activation can trigger inappropriate reads, command execution, or DNS changes, making this more than a mere documentation quality issue.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill describes deletion of DNS records without placing a strong up-front warning and confirmation requirement in the primary usage flow. DNS deletion is a destructive infrastructure action that can immediately break domain resolution and cause outages, so presenting it without prominent safeguards increases the risk of accidental or unauthorized service disruption.

Static analysis

No suspicious patterns detected.