Namecheap DNS

Manage Namecheap DNS records safely by fetching existing entries, merging changes, auto-backing up, previewing diffs, dry-running, and rolling back updates.

This skill appears to implement a legitimate Namecheap DNS helper, but the metadata published with the skill is incomplete. Before installing or running it: (1) expect to set NAMECHEAP_API_KEY, NAMECHEAP_USERNAME, and NAMECHEAP_API_USER in your environment — the script will exit without them; (2) ensure the host has 'dig' (the script calls dig via execSync) and you understand npm install will pull dependencies into the skill folder; (3) Namecheap requires your client IP to be whitelisted — the script queries https://ifconfig.me/ip to obtain your IP and sends it to the API; (4) backups are written to disk (default skill/backups or configurable via NAMECHEAP_BACKUP_DIR) so verify the storage location and permissions; (5) review package.json/package-lock.json (axios and common deps) and audit/install in a controlled environment if you don't trust the source. The primary issue is inconsistency between what the skill actually requires and what the registry metadata declares — if you intend to use it, request the publisher correct the metadata or confirm the required env vars and the need for 'dig' before proceeding.

Type: OpenClaw Skill Name: namecheap-dns Version: 1.1.0 The skill's stated purpose and overall design are benign, aiming to provide a safer wrapper for Namecheap DNS management. However, the `namecheap-dns.js` script contains a shell injection vulnerability. User-controlled inputs (`fullDomain` and `sub`) are directly interpolated into `execSync` calls for the `dig` command (e.g., `execSync(`dig +short ${fullDomain} ${type}`)`). This lack of input sanitization could allow an attacker to execute arbitrary commands if they can control the domain argument, making it a critical vulnerability, but not evidence of intentional malicious behavior.