godaddy-skill
Pass
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
digutility to check DNS propagation.\n - Evidence:
subprocess.run([\"dig\", ...])ingodaddy_skill.py.\n - Context: Arguments are passed as a list without
shell=True, effectively mitigating shell injection risks.\n- [DATA_EXFILTRATION]: The skill reads stored API credentials and transmits them to GoDaddy's API for authentication.\n - Evidence:
api_requestfunction ingodaddy_skill.pyuses credentials fromconfig.json.\n - Context: This is standard and necessary functionality for an API-based management tool, targeting the official service domain.\n- [PROMPT_INJECTION]: The skill displays data fetched from the GoDaddy API, which represents an indirect prompt injection surface.\n
- Ingestion points: Result data from
api_request(e.g., domain names, DNS record values) ingodaddy_skill.py.\n - Boundary markers: Not present.\n
- Capability inventory: API record updates and local
digexecution.\n - Sanitization: Data is parsed as JSON and the user is explicitly warned to confirm changes.
Audit Metadata