ClawHub
Back to skill

Security audit

abe-dexter

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent financial research helper, but its install instructions fetch and run unpinned third-party code while persisting API keys and routing future queries through external services.

Review this before installing. Use only non-confidential financial queries, pin the Dexter repository to a reviewed commit, install as an unprivileged user, use a locked dependency install where possible, protect the .env file with owner-only permissions, and understand that future prompts and research context may be sent to SkillBoss, Financial Datasets, and web search services.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:37
Finding

Unpinned Remote Code and Dependency Execution

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:51
Finding

API Credentials Stored Without Restrictive File Permissions

Content
View full analysis
"$DEXTER_DIR/.env" << 'EOF' # SkillBoss API Hub Key - covers LLM (chat) and web search SKILLBOSS_API_KEY=your-skillboss-key # Stock Market API Key - Get from https://financialdatasets.ai FINANCIAL_DATASETS_API_KEY=your-financial-datasets-key EOF ``` The one-shot installation flow repeats the issue: ```bash cat > .env << EOF SKILLBOSS_API_KEY=${SKILLBOSS_API_KEY:-your-skillboss-key} FINANCIAL_DATASETS_API_KEY=${FINANCIAL_DATASETS_API_KEY:-your-key-here} # SkillBoss API Hub is Anthropic-compatible; route LLM calls through it ANTHROPIC_API_KEY=${SKILLBOSS_API_KEY:-your-skillboss-key} ANTHROPIC_BASE_URL=https://api.heybossai.com/v1 EOF ``` ### Technical Analysis The instructions write API credentials directly into a plaintext `.env` file but do not set a restrictive `umask`, create the file with mode `0600`, or apply secure permissions afterward. The resulting permissions depend on the user's current umask. With a common umask such as `022`, a newly created file may be readable by other local users. The second example also duplicates the SkillBoss credential into both `SKILLBOSS_API_KEY` and `ANTHROPIC_API_KEY`, increasing the number of credential-bearing configuration entries. Although plaintext environment files are common, they require explicit access controls and exclusion from source control, logs, backups, and other unintended disclosure channels. ### Attack Path 1. A user follows the documented setup and writes valid API credentials to `.env`. 2. The shell creates the file according to the current umask, without an explicit restrictive mode. 3. Another local user, compromised process, or service account with filesystem access reads the file. 4. The exposed credentials are used t ...[truncated 749 chars]
Remediation
View remediation
"$DEXTER_DIR/.env" << 'EOF' SKILLBOSS_API_KEY=your-skillboss-key FINANCIAL_DATASETS_API_KEY=your-financial-datasets-key EOF ``` 2. Explicitly enforce ownership-only access after creation: ```bash chmod 600 "$DEXTER_DIR/.env" ``` 3. Ensure the containing directory is not accessible to unrelated users, for example by applying mode `0700`. 4. Prefer an operating-system secret store, container secret, or managed secrets service instead of persistent plaintext files where supported. 5. Add `.env` to `.gitignore` and verify that it is excluded from logs, diagnostic bundles, shared backups, and version-control history. 6. Use narrowly scoped API keys with usage limits and rotate them immediately if exposure is suspected. 7. Avoid unnecessary duplication of the same secret under multiple environment-variable names where the application's configuration can be changed safely. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

Create .env file with required API keys:

bash
cat > "$DEXTER_DIR/.env" << 'EOF'
# SkillBoss API Hub Key - covers LLM (chat) and web search
SKILLBOSS_API_KEY=your-skillboss-key

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

Create .env file with required API keys:

bash
cat > "$DEXTER_DIR/.env" << 'EOF'
# SkillBoss API Hub Key - covers LLM (chat) and web search
SKILLBOSS_API_KEY=your-skillboss-key

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

Create .env file with required API keys:

bash
cat > "$DEXTER_DIR/.env" << 'EOF'
# SkillBoss API Hub Key - covers LLM (chat) and web search
SKILLBOSS_API_KEY=your-skillboss-key

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md
# Install deps
bun install

# Create .env (set these variables before running)
cat > .env << EOF
SKILLBOSS_API_KEY=${SKILLBOSS_API_KEY:-your-skillboss-key}
FINANCIAL_DATASETS_API_KEY=${FINANCIAL_DATASETS_API_KEY:-your-key-here}

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md
# Install deps
bun install

# Create .env (set these variables before running)
cat > .env << EOF
SKILLBOSS_API_KEY=${SKILLBOSS_API_KEY:-your-skillboss-key}
FINANCIAL_DATASETS_API_KEY=${FINANCIAL_DATASETS_API_KEY:-your-key-here}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill advertises autonomous financial research but does not clearly disclose that user financial queries may be sent to third-party services, including SkillBoss API Hub, Financial Datasets, and web search providers. This creates a data handling and privacy transparency issue because users may unknowingly transmit sensitive investment research, internal company analysis, or proprietary prompts off-host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The installation instructions create a .env file containing API credentials and modify local source/configuration files via sed and settings writes, but do not prominently warn the user about these side effects. This is dangerous because users may execute the commands without realizing they are persisting secrets to disk and patching checked-out code, which can affect future behavior, audits, and secret exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This configuration explicitly routes model requests to an external endpoint at api.heybossai.com, meaning prompts and possibly retrieved financial context are transmitted off-machine. In the context of a financial research agent, that may expose sensitive business questions, proprietary analysis, or regulated data if users are not warned.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

Set SkillBoss API key as the Anthropic credential (SkillBoss is API-compatible)

echo "ANTHROPIC_API_KEY=${SKILLBOSS_API_KEY}" >> "$DEXTER_DIR/.env" echo "ANTHROPIC_BASE_URL=https://api.heybossai.com/v1" >> "$DEXTER_DIR/.env"

text

### 4. Configure Model Settings

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The one-shot installation script persists configuration that routes future LLM traffic to a third-party API endpoint, creating ongoing external transmission risk beyond the immediate install step. Because this is embedded in an install script, users may not notice that later queries will leave the local environment.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

md
FINANCIAL_DATASETS_API_KEY=${FINANCIAL_DATASETS_API_KEY:-your-key-here}
# SkillBoss API Hub is Anthropic-compatible; route LLM calls through it
ANTHROPIC_API_KEY=${SKILLBOSS_API_KEY:-your-skillboss-key}
ANTHROPIC_BASE_URL=https://api.heybossai.com/v1
EOF

# Route small model calls through SkillBoss API Hub