gddy
Fail
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides setup instructions that download and execute scripts from GoDaddy's official GitHub repository (
github.com/godaddy/cli) by piping them directly to shell interpreters (bashandiex). - [EXTERNAL_DOWNLOADS]: The documentation references official API endpoints and OpenAPI specification files hosted on GoDaddy's developer infrastructure (
developer.godaddy.comandapi.godaddy.com). - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data such as domain search results and DNS record values that could contain instructions intended to influence the agent's behavior during sensitive operations like domain purchases or DNS updates.
- Ingestion points: External data is ingested via the outputs of
gddy searchandgddy dns listcommands. - Boundary markers: There are no explicit boundaries or warnings provided to the agent to ignore potentially malicious instructions embedded within domain records or search results.
- Capability inventory: The skill possesses high-impact capabilities including financial domain registration (
gddy domain purchase) and modification of DNS records (gddy dns add/set/delete). - Sanitization: No sanitization or validation of the data returned by the CLI is performed before it is used for decision-making.
Recommendations
- HIGH: Downloads and executes remote code from: https://github.com/godaddy/cli/releases/latest/download/install.sh - DO NOT USE without thorough review
Audit Metadata