Domain Name Registration For Agents

• Outcome: Review
• Latest audit: May 28, 2026, 2:15 AM
• Version:
  1.0.1

Overview

This skill does what it says, but it can spend real USDC to register domains and change live DNS without clear approval guardrails.

Install only if you are comfortable letting an agent use a dedicated low-balance wallet for domain purchases and DNS administration. Pin and review the external client package, keep wallet files protected, confirm every domain, price, term, DNS record, and nameserver change before execution, and keep a backup of existing DNS settings for rollback.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill enables high-impact external actions—domain registration, DNS modification, and nameserver changes—that can incur irreversible costs or break service ownership/routing, but it does not instruct the agent to obtain explicit user confirmation immediately before performing them. In an agent context, this creates a real risk of unauthorized purchases, service disruption, traffic hijacking, or accidental lockout if the model acts on ambiguous prompts or inferred intent.

VirusTotal

63/63 vendors flagged this skill as clean.