nextdns-cli

Fail

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: Instructions describe downloading and executing an installer from a remote server. Evidence: sh -c "$(curl -sL https://nextdns.io/install)" in rules/installation.md. The domain is the official site for NextDNS, a well-known service provider.
  • [EXTERNAL_DOWNLOADS]: Fetches repository GPG keys from an external source during Linux setup. Evidence: wget -O /etc/apk/keys/nextdns.pub https://repo.nextdns.io/nextdns.pub in rules/linux-advanced.md.
  • [COMMAND_EXECUTION]: Employs administrative privileges to manage system-level DNS settings and services. Evidence: Extensive use of sudo nextdns and sudo systemctl across the documentation (e.g., rules/systemd-advanced.md).
  • [INDIRECT_PROMPT_INJECTION]: The skill uses user-provided profile IDs in command execution, which could be exploited if malicious input is provided. 1. Ingestion points: Profile ID parameter in rules/installation.md. 2. Boundary markers: Absent. 3. Capability inventory: High-privilege command execution (sudo), file system modification (/etc/resolv.conf), and network access (curl). 4. Sanitization: Absent.
Recommendations
  • CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
Sep 17, 2026, 05:23 PM