Porkbun Domains & DNS

Manage domains and DNS via the Porkbun API. Use when asked to list domains, check domain availability, manage DNS records (A, AAAA, CNAME, MX, TXT, etc.), up...

This skill appears to do what it claims (Porkbun domain/DNS management) and only needs your Porkbun API keys. However, the bundled script unsafely uses eval to export variables from a workspace .env file — if that .env is modified by an attacker or contains unexpected content, the script could execute arbitrary shell commands. Before installing or running: (1) inspect scripts/porkbun.sh yourself (you already have it); (2) avoid placing untrusted content in ~/.openclaw/workspace/.env or set PORKBUN_API_KEY and PORKBUN_SECRET_KEY directly in your environment instead; (3) ensure runtime tools (curl, jq, bash) are available; (4) consider patching the script to safely parse the .env (do not use eval; parse assignments and strip unsafe characters) or refuse to read a .env file at all. If the .env loading were rewritten to avoid eval (or removed) and runtime dependencies documented, this would be coherent and lower-risk.

Type: OpenClaw Skill Name: porkbun-domains Version: 1.0.0 The skill provides legitimate Porkbun API management functionality, but scripts/porkbun.sh contains a shell injection vulnerability. It uses eval on the output of grep/sed when loading credentials from a .env file, which could allow arbitrary code execution if the environment file is tampered with. While the behavior aligns with the stated purpose and uses the official Porkbun API (api.porkbun.com), the insecure handling of configuration files meets the threshold for a suspicious classification.