intodns
Verdict safe, but 2 findings (2 medium), mainly prompt injection, command injection. Most recent scan 2026-02-06.
The IntoDNS skill presents MEDIUM security risks primarily related to transitive trust abuse and potential command injection. The skill directs the agent to execute curl commands against an external API (intodns.ai) and trust responses without validation, creating an indirect prompt injection vector. Additionally, domain input validation guidance is insufficient to prevent command injection attacks. The skill does not include executable scripts (only bash commands in instructions), which reduces attack surface. Missing optional metadata (allowed-tools, license, compatibility) and a referenced but missing file (the.py) are minor documentation issues. The skill would benefit from explicit input validation requirements, response sanitization guidance, and consideration of using safer HTTP libraries instead of shell-based curl commands.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
SkillSpector found no issues but could not fully inspect the package, usually because SKILL.md refers to a file that is not present, so it fails closed to CAUTION instead of SAFE. Read it as "not fully checked", not as a finding. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
DNS & email security analysis powered by IntoDNS.ai - scan domains for DNS, DNSSEC, SPF, DKIM, DMARC issues
- Package
- 1 file, 4.7 KB
- SKILL.md
- 657 words, 12+ sections
- Code
- None. Instructions only.
- Homepage
- https://intodns.ai
SKILL.md covers: IntoDNS - DNS & Email Security Analysis · When to activate · How to perform a scan · Step 1: Validate the domain · Step 2: Run the quick scan · Step 3: Run additional checks if needed · Output formatting · 1. Score header · DNS Health Report: example.com · 2. Category breakdown · 3. Issues · Issues Found
Findings
MEDIUM Transitive Trust Abuse - Unvalidated External API Responses Prompt Injectionllm
The skill instructs the agent to execute curl commands against an external API (intodns.ai) and implicitly trust the responses without validation. The agent is directed to parse and present JSON responses from this third-party service directly to users. If the API is compromised or returns malicious content (e.g., embedded instructions, misleading data), the agent would follow that content without verification. This creates an indirect prompt injection vector where untrusted external content could influence agent behavior.
SKILL.md
Instructions direct agent to: 'curl -s "https://intodns.ai/api/scan/quick?domain=DOMAIN"' and present results directly. No validation of response content, structure, or authenticity is specified. Agent trusts external API responses implicitly.MEDIUM Command Injection Risk - Unvalidated Domain Input Command Injectionllm
The skill instructs the agent to insert user-provided domain names directly into curl commands without explicit validation or sanitization guidance. While the instructions mention stripping protocols and paths, there is no guidance on validating against command injection characters (semicolons, pipes, backticks, etc.). A malicious user could provide input like 'example.com; rm -rf /' or 'example.com`malicious-command`' which could be executed by the shell if the agent doesn't properly sanitize the input.
SKILL.md
Instructions state: 'curl -s "https://intodns.ai/api/scan/quick?domain=DOMAIN"' where DOMAIN is extracted from user input. Validation guidance only mentions stripping protocols/paths, not shell metacharacters. Example: user input 'example.com; cat /etc/passwd' could lead to command injection.What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 4.7 KB |
External hosts referenced
intodns.ai
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/intodns
- Raw scan result: intodns-scan.json
- Badge for your README:
- Request a re-scan