Saucebox Registry
← Browse

@zakirkun/subdomain-takeover-risk

B

Detects CNAME records pointing to cloud services that may be dangling, and configurations referencing external services vulnerable to takeover.

skillclaude

Install

agr install @zakirkun/subdomain-takeover-risk --target claude

Writes 2 files into .claude/skills/, pinned to git-1a970f17.

  • .claude/skills/subdomain-takeover-risk/SKILL.md
  • .claude/skills/subdomain-takeover-risk/patterns.yaml

Document

confidence: medium cwe: - CWE-350 description: Detects CNAME records pointing to cloud services that may be dangling, and configurations referencing external services vulnerable to takeover. languages: - javascript - typescript - yaml - generic - kotlin - dart - zig - elixir name: Subdomain Takeover Risk owasp: - A05:2025 severity: high tags: - web - subdomain-takeover - dns - owasp-a05 version: 1.0.0

Subdomain Takeover Risk

Overview

Subdomain takeover occurs when a DNS CNAME points to a third-party service (GitHub Pages, Heroku, S3, Netlify) whose content has been removed. An attacker can claim the now-unclaimed resource on the third-party platform and host malicious content that browsers serve under the original company's subdomain.

Remediation

  • Regularly audit DNS records and remove CNAMEs for deprovisioned services
  • Before deprovisioning cloud resources, remove DNS records first
  • Monitor subdomain availability with tools like can-i-take-over-xyz

Trustgrade B

  • passBody integrity

    Whether the stored document is plausibly the kind of file the artifact declares, rather than something fetched by mistake.

  • passType matchnot applicable to this artifact type

    Whether the artifact is really the kind of thing its metadata claims it is.

  • passFreshness

    How long since the source repository was last pushed to.

  • passPrompt injection

    Scans the artifact's own text for instructions aimed at your agent rather than at you.

  • warnLicenseno SPDX license detected

    Whether the source repository declares an SPDX license permissive enough to redistribute.

How the grade is calculated

Each check contributes 0 points when it passes, 1 when it warns, and 2 when it fails. The total maps to a letter:

  • Aevery check passed
  • Bone warning
  • Ctwo warnings
  • Dprompt injection or body integrity failed, or three warnings
  • Fone of those failed, and something else is wrong

These are automated hygiene checks, not a security audit, and not a dependency or vulnerability scan. A grade of A means nothing was flagged — not that the artifact is safe.

Versions

  • git-1a970f17a1bb2026-07-31