Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- dist/api.js:56
- Evidence
const base = trimmed(settings.apiBase) ?? trimmed(process.env.DNSDOCTOR_API_BASE) ?? DEFAULT_API_BASE;
Security audit
DNS Doctor
Security checks for vulnerabilities and agentic risk
Overview
This plugin coherently exposes DNS Doctor tools for DNS and email-authentication checks, using a disclosed remote API and optional account token.
Install if you are comfortable sending DNS queries and any uploaded DMARC report files to DNS Doctor. Use an API token only for your own monitored domains, keep it out of committed files, and do not change apiBase unless you trust that server because the token is sent there.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.env_credential_access