nextdns-cli
Fail
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Instructions describe downloading and executing an installer from a remote server. Evidence:
sh -c "$(curl -sL https://nextdns.io/install)"inrules/installation.md. The domain is the official site for NextDNS, a well-known service provider. - [EXTERNAL_DOWNLOADS]: Fetches repository GPG keys from an external source during Linux setup. Evidence:
wget -O /etc/apk/keys/nextdns.pub https://repo.nextdns.io/nextdns.pubinrules/linux-advanced.md. - [COMMAND_EXECUTION]: Employs administrative privileges to manage system-level DNS settings and services. Evidence: Extensive use of
sudo nextdnsandsudo systemctlacross the documentation (e.g.,rules/systemd-advanced.md). - [INDIRECT_PROMPT_INJECTION]: The skill uses user-provided profile IDs in command execution, which could be exploited if malicious input is provided. 1. Ingestion points: Profile ID parameter in
rules/installation.md. 2. Boundary markers: Absent. 3. Capability inventory: High-privilege command execution (sudo), file system modification (/etc/resolv.conf), and network access (curl). 4. Sanitization: Absent.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
Audit Metadata