Porkbun

Manage Porkbun DNS records and domains via API v3. Use when Codex needs to create, read, update, or delete DNS records on Porkbun; list domains; configure API access; work with common record types (A, AAAA, CNAME, MX, TXT, etc.). The skill includes a CLI tool `scripts/porkbun-dns.js` for executing DNS operations reliably.

This skill appears to be what it claims (a Porkbun DNS CLI). Before installing or providing credentials: 1) Verify the skill source (homepage in package.json points to an external git host; confirm you trust the owner). 2) Prefer exporting ephemeral API keys or use a key pair with minimal privileges; rotate keys after use. 3) If using the config file (~/.config/porkbun/config.json), restrict file permissions (e.g., chmod 600). 4) Review the script if possible — it posts credentials only to api.porkbun.com; look for unexpected endpoints. 5) Note the registry metadata inconsistency (it listed no required env vars while package.json and SKILL.md do); correct metadata or confirm requirements before automating deployment. Finally, the script has a minor bug (uses console.err which is undefined) but that is not a security issue — it's a quality note.

Type: OpenClaw Skill Name: porkbun-skill Version: 0.1.2 The OpenClaw skill 'porkbun-skill' is designed for managing Porkbun DNS records via their API. The `scripts/porkbun-dns.js` script correctly implements API interactions, loads credentials from environment variables or a standard config file (`~/.config/porkbun/config.json`), and performs only the stated DNS operations. There is no evidence of intentional harmful behavior such as data exfiltration to unauthorized endpoints, persistence mechanisms, or obfuscation. The `SKILL.md` instructions are clear and directly relate to DNS management, and the `curl -s ifconfig.me` example is a common, non-malicious pattern for dynamic DNS updates.