Security audit

dexter

Security checks for vulnerabilities and agentic risk

Overview

Dexter is a coherent financial research skill, but its install instructions run mutable third-party code and store API keys in plaintext without enough safeguards.

Review before installing. Use a least-privileged or containerized environment, pin the Dexter repository to a commit you trust, use frozen dependency installs where possible, and avoid running the setup as root. Store API keys with restrictive permissions or inject them at runtime, add .env to ignore rules, and disable or omit Tavily if your research queries are confidential.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

Location: SKILL.md:34
Finding: Unpinned Remote Repository and Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:52
Finding: API Credentials Written to a Plaintext File Without Explicit Permission Hardening
Content: View full analysis
"$DEXTER_DIR/.env" << 'EOF' # LLM API Keys (at least one required) ANTHROPIC_API_KEY=your-anthropic-key # Stock Market API Key - Get from https://financialdatasets.ai FINANCIAL_DATASETS_API_KEY=your-financial-datasets-key # Web Search API Key - Get from https://tavily.com (optional but recommended) TAVILY_API_KEY=your-tavily-key EOF ``` The one-shot installer similarly writes inherited credentials into a plaintext file: ```bash cat > .env << EOF ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-your-key-here} FINANCIAL_DATASETS_API_KEY=${FINANCIAL_DATASETS_API_KEY:-your-key-here} TAVILY_API_KEY=${TAVILY_API_KEY:-your-key-here} EOF ``` ### Technical Analysis The installation instructions persist sensitive API credentials in a plaintext `.env` file without first setting a restrictive `umask` or explicitly applying permissions such as mode `0600`. The resulting access permissions depend on the user's existing umask and the permissions of parent directories. In an environment with permissive defaults, other local users or processes may be able to read the credentials. The instructions also do not state that `.env` must be excluded from version control, backups, logs, or other unintended distribution channels. The one-shot heredoc expands environment variables while creating the file. Although the values are not directly placed in command-line arguments, they are still persisted unencrypted and become available to every process with sufficient filesystem access. ### Attack Path 1. A user runs the documented configuration procedure under a permissive umask or in a shared environment. 2. The `.env` file is created with permissions that allow access beyond its intended owner, or it is inadvertently included in version control or back ...[truncated 1013 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs users to place live API keys into a plaintext .env file under a predictable workspace path without warning about local credential exposure, file permissions, shell history, backups, or accidental commits. While common in developer tooling, this still increases the risk of credential leakage from multi-user systems, compromised workspaces, or source-control mistakes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill states that international-stock queries fall back to Tavily web search, but it does not clearly warn users that their prompts and possibly company-specific research terms may be transmitted to a third-party search provider. This creates an avoidable privacy and data-governance risk, especially for sensitive or proprietary financial research workflows.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.