skills/mukul975/anthropic-cybersecurity-skills/analyzing-typosquatting-domains-with-dnstwist/Gen Agent Trust Hub
analyzing-typosquatting-domains-with-dnstwist
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the dnstwist command-line tool via subprocess.run to generate and analyze domain permutations. These calls are implemented using argument lists rather than shell strings, which is a standard security best practice to prevent command injection.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources during analysis. Ingestion points: User-provided domain strings and DNS records (A, AAAA, MX, NS) retrieved from remote nameservers. Boundary markers: None present in the provided scripts to distinguish external data from instructions. Capability inventory: System command execution (dnstwist), network operations (DNS resolution), and file writing (JSON results and Markdown reports). Sanitization: Basic domain string parsing is performed.
- [EXTERNAL_DOWNLOADS]: The documentation includes instructions to install the dnstwist package from official Python registries and mentions enrichment via well-known security services like VirusTotal, both of which are standard in a threat intelligence context.
Audit Metadata