Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- dist/api.js:56
- Evidence
const base = trimmed(settings.apiBase) ?? trimmed(process.env.DNSDOCTOR_API_BASE) ?? DEFAULT_API_BASE;
Security audit
DNS Doctor
Security checks for vulnerabilities and agentic risk
Overview
This plugin is a disclosed DNS Doctor integration that sends DNS-related queries and optional monitoring credentials to the DNS Doctor API for domain diagnostics.
Install only if you are comfortable sending queried domain names, DNS records, and uploaded DMARC aggregate reports to DNS Doctor. If you configure an API token, treat it as a credential and keep it in environment or plugin config rather than committed files; generated DNS records should still be reviewed and published by a human domain owner.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.env_credential_access