adguard
4 findings (1 critical, 2 high, 1 medium), mainly data exfiltration, command injection, social engineering. Most recent scan 2026-02-05.
This AdGuard Home controller skill presents CRITICAL and HIGH severity security risks primarily related to credential handling, command injection vulnerabilities, and network security. The skill requires admin credentials transmitted over HTTP to user-configurable endpoints, stores session tokens in predictable temporary locations, and lacks input validation for domain parameters enabling command injection attacks. While the skill's core functionality (managing DNS filtering via API) is legitimate, the implementation has significant security gaps. The skill should NOT be used in production without addressing the critical credential exposure and command injection vulnerabilities. Medium-severity issues around error handling and documentation transparency should also be resolved.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Control AdGuard Home DNS filtering via HTTP API. Use when managing blocklists/allowlists, checking domain filtering status, toggling protection, or clearing DNS cache. Supports blocking/allowing domains, viewing statistics, and protecting/disabling DNS filtering.
- Package
- 4 files, 21 KB
- SKILL.md
- 641 words, 12+ sections
- Code
- Shell (1)
SKILL.md covers: AdGuard Home Controller · Requirements · Quick Start · Set password once · Use commands · Configuration · Config File Alternative · Commands · check `<domain>` · ✗ doubleclick.net IS BLOCKED · Blocked by: Adblock Plus filter · ✓ example.com is NOT blocked (allowed)
Findings
CRITICAL Hardcoded Credentials and Credential Exposure Risk Data Exfiltrationllm
The skill requires users to set ADGUARD_PASSWORD as an environment variable and stores session cookies in predictable temporary files (/tmp/adguard_cookie_$$.txt). While environment variables are mentioned, the instructions encourage storing credentials in shell configuration files (~/.bashrc, ~/.zshrc) which persists credentials in plaintext. Additionally, the cookie file cleanup relies on trap handlers which may not execute if the script is killed forcefully, leaving session tokens exposed in /tmp.
scripts/adguard.sh
ADGUARD_PASSWORD="${ADGUARD_PASSWORD}" and COOKIE_FILE="/tmp/adguard_cookie_$$.txt" with trap cleanup that may fail on SIGKILLHIGH Command Injection via Domain Parameter Command Injectionllm
The bash script accepts domain names as command-line arguments and passes them directly to curl commands without proper validation or sanitization. An attacker could inject shell metacharacters in domain arguments to execute arbitrary commands. For example: './adguard.sh check "example.com; rm -rf /"' could lead to command execution.
Domain parameters from $2, $3 are used directly in curl commands and string interpolation without escaping or validationHIGH Network Communication to User-Controlled Endpoint Data Exfiltrationllm
The skill makes HTTP API calls to a user-configurable endpoint (ADGUARD_URL) which defaults to a local network address but can be set to any URL. This creates risk if an attacker can manipulate the ADGUARD_URL environment variable to point to a malicious server, potentially capturing credentials or serving malicious responses. The script transmits admin credentials to this endpoint.
scripts/adguard.sh
ADGUARD_URL="${ADGUARD_URL:-http://192.168.68.97:3000}" allows arbitrary URL configuration, credentials sent via POST to ${API_BASE}/loginMEDIUM Incomplete Documentation of Network Requirements Social Engineeringllm
The skill description and manifest do not clearly indicate that this skill makes network HTTP requests to external devices (AdGuard Home server). Users might not realize this skill communicates over the network, potentially crossing security boundaries. The compatibility field is not specified, which should indicate network requirements.
SKILL.md
Description mentions 'HTTP API' but manifest lacks compatibility field and network requirement warningsWhat is in the package
| File | Kind | Size |
|---|---|---|
README.md | doc | 3.1 KB |
SKILL.md | doc | 5.1 KB |
references/api.md | doc | 4.7 KB |
scripts/adguard.sh | script | 8.4 KB |
External hosts referenced
github.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
ADGUARD_PASSWORD ADGUARD_URL API_BASE ADGUARD_USERNAME
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/adguard
- Raw scan result: adguard-scan.json
- Badge for your README:
- Request a re-scan