implementing-zero-trust-dns-with-nextdns

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes explicit examples that embed a NextDNS profile ID and API key directly into URLs, headers, and CLI arguments (e.g., "abc123" and "your-api-key" in curl and install commands), which instructs an agent to place secret/credential values verbatim into generated commands or requests.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The SKILL.md includes an install command that executes a remote script fetched via curl (sh -c 'sh -e $(curl -sL https://nextdns.io/install)'), meaning https://nextdns.io/install is fetched and executed at runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill includes explicit sudo commands and installation steps that modify system configuration files (e.g., /etc/systemd/resolved.conf) and restart system services, which instruct the agent to change the host machine's state with elevated privileges.