Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- dist/api.js:49
- Evidence
const base = trimmed(settings.apiBase) ?? trimmed(process.env.DNSDOCTOR_API_BASE) ?? DEFAULT_API_BASE;
Security audit
DNS Doctor
Security checks across malware telemetry and agentic risk
Overview
This is a coherent DNS Doctor OpenClaw plugin that exposes disclosed DNS and email-authentication diagnostic tools through the DNS Doctor API.
Before installing, be aware that domains you scan, pasted records, and any DMARC report files you parse are sent to the configured DNS Doctor API endpoint. Only configure an API token if you want the plugin to read your monitored-domain alert/readiness data, and avoid pointing apiBase at an untrusted endpoint because the token would be sent there.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
60/60 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.env_credential_access