drillr — Power Terminal for Deep Financial Research

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:19 AM UTC
• Version: 1.0.1

Overview

The skill is mostly coherent for Drillr financial research, but it asks users to paste a live API key into chat and stores long-lived credentials, so it should be reviewed before installation.

Install only if you are comfortable using Drillr as an external finance-data service and giving it an API key. Do not paste live API keys into ordinary chat; prefer a local secret store, environment injection, or a secure OAuth/device-style flow if available. If you use the CLI, pin and verify the package version rather than installing the latest global npm package blindly, and revoke any key that was previously pasted into chat.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:95

Finding

API Key Exposure Through Chat and Plaintext Shell Configuration

Content

View full analysis

To use Drillr I need an API key. From any browser (your phone is > fine): > > 1. Open https://drillr.ai/developer/keys > 2. Sign in — **Google sign-in is the quickest**; email/password also > works > 3. Tap "Create API key" → give it a name (e.g. "my-agent") → copy > the `drl_...` string > 4. Paste it back to me here. The key is shown only once. > > After I confirm it works, you can delete your message. ``` ```markdown **Rules:** - Never echo the full key back to the user - Never write the key into conversation logs, prompts, or scratchpads - Never commit it to any file other than `~/.config/drillr/config.json` ``` From `SKILL.md:179-180`: ```markdown > 3. Add `export DRILLR_API_KEY=drl_...` to your shell rc > (`~/.zshrc` / `~/.bashrc`) and restart the shell ``` The same chat-based credential collection and shell configuration instructions are duplicated in `examples/user-onboarding-script.md`. ### Technical Analysis The indirect onboarding flow explicitly instructs users to paste a long-lived bearer API key into a chat conversation. This conflicts with the Skill's own rule prohibiting API keys from being written into conversation logs. Once submitted, the credential may be retained in server-side chat history, agent traces, model-provider logs, telemetry, backups, notification previews, or connected integrations. Telling the user to delete the message after validation does not guarantee removal from those secondary storage systems. Anyone able to read one of those systems could recover the credential. The direct onboarding flow also recommends putting the key in `.zshrc` or `.bashrc`. Shell startup files a ...[truncated 1790 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:184

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

``` > npm install -g drillr-cli > drillr auth set-key drl_... > drillr watchlist list # should succeed (empty is fine) > ``` ``` ### Technical Analysis The Skill instructs users to install the latest available version of `drillr-cli` globally without an exact version, lockfile, integrity value, or other reproducibility control. The package implementation is not included in the audited project, so its behavior cannot be verified from this repository. Because the version is unresolved, the effective code installed by this instruction can change after the Skill has been audited. A compromised npm publisher account, malicious future release, or package registry incident could therefore introduce attacker-controlled code without any modification to this project. Global npm installation also increases exposure because package lifecycle scripts and installed executables run with the permissions of the invoking user and become available across the user's environment. The audit did not find evidence that the current package is malicious; the finding concerns the unsafe and mutable dependency installation process. ### Attack Path 1. An attacker compromises the npm publisher account, release process, or another component used to distribute `drillr-cli`. 2. The attacker publishes a malicious version under the expe ...[truncated 1157 chars]

Remediation

View remediation

``` Use `--ignore-scripts` only if the verified package does not require lifecycle scripts. 2. Publish and verify the expected package integrity hash and provenance for the pinned release. 3. Document the verified npm package owner and canonical package URL to reduce package-substitution risk. 4. Prefer a project-local installation over a global installation where practical. 5. Use a lockfile for any repository-managed dependency installation. 6. Review package contents, transitive dependencies, lifecycle scripts, and release provenance before recommending a new version. 7. Prefer the documented HTTPS MCP or REST integration when users do not specifically require the CLI. 8. Establish a controlled update process so version changes receive a new security review before the Skill documentation is updated. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (17)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 340)May include surrounding context.

md

| `watchlist_list`                                     | `GET /api/v1/watchlists`                          |
| `watchlist_create({ name, tickers? })`               | `POST /api/v1/watchlists`                         |
| `watchlist_add({ ticker, watchlist_name? })`         | `POST /api/v1/watchlists/:id/tickers`             |
| `watchlist_remove({ ticker, watchlist_name? })`      | `DELETE /api/v1/watchlists/:id/tickers/:ticker`   |
| `watchlist_delete({ watchlist_name })`               | `DELETE /api/v1/watchlists/:id`                   |

CLI: `drillr watchlist {list|create|add|remove|delete}` — see

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 341)May include surrounding context.

md

| `watchlist_create({ name, tickers? })`               | `POST /api/v1/watchlists`                         |
| `watchlist_add({ ticker, watchlist_name? })`         | `POST /api/v1/watchlists/:id/tickers`             |
| `watchlist_remove({ ticker, watchlist_name? })`      | `DELETE /api/v1/watchlists/:id/tickers/:ticker`   |
| `watchlist_delete({ watchlist_name })`               | `DELETE /api/v1/watchlists/:id`                   |

CLI: `drillr watchlist {list|create|add|remove|delete}` — see
`drillr watchlist --help`.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 419)May include surrounding context.

md

Client Registration (e.g., Claude Code's built-in MCP OAuth). This
skill deliberately does **not** cover that path because:

- OAuth access tokens expire hourly and require client-side refresh
  that not all MCP runtimes implement correctly
- The browser callback step assumes the user and agent share a
  machine; Path A deployments (remote host / IM-driven) cannot

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This onboarding prompt operationalizes secret exfiltration into natural-language workflow by telling the user to create a live API key and paste it back into the conversation. In the context of an agent skill, that is especially dangerous because the model, platform, plugins, logs, or future prompts may gain access to the credential, turning ordinary onboarding into credential capture.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The onboarding script explicitly instructs users to paste a live Drillr API key into the chat, which exposes a credential through the agent conversation channel. Even if the message is later deleted or masked in follow-up text, the secret may already be retained in chat history, logs, telemetry, screenshots, or accessible to the agent runtime, enabling unauthorized API use.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The retry and revocation templates repeatedly ask the user to generate and paste fresh API keys into chat, multiplying the chance that valid credentials are exposed and retained. Repetition worsens the risk because revoked or failed-key scenarios often lead users to create multiple active secrets, any of which may remain usable if mishandled.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The documented onboarding and multi-channel design indicate session or credential persistence across agent interactions, especially where the same drl_* API key is reused and stored for later use. Persistence of authentication state is risky in an agent context because it can enable unintended future actions, broaden consequences of prompt injection elsewhere, and retain access longer than the user expects.

Content

Scanner excerpt · CHANGELOG.md (reported line 8)May include surrounding context.

md

## [1.0.0] — 2026-04-23

Initial release. Complete rewrite of the earlier repository contents.

### What's covered

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The changelog explicitly documents a workflow where a user pastes an API key into chat and the agent persists it to ~/.config/drillr/config.json. That expands the skill from financial research into secret collection and local secret storage, which increases the attack surface and creates risk of accidental disclosure, misuse by other local processes, or persistence beyond user intent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Persisting API credentials to a local config file is not inherently required for researching stocks or company financials, so the documented behavior exceeds the core functional purpose of the skill. Even with mode 0600, local file storage can still expose secrets through backups, logs, endpoint compromise, multi-tool access, or user misunderstanding about how long credentials remain available.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly says the skill will help an agent onboard the user and collect an API key, but it does not warn how that credential will be handled, stored, or protected. In an agent-skill context, requesting secrets through conversational flows increases the risk of accidental disclosure to logs, third-party runtimes, prompts, or misconfigured integrations, so the omission is a real security concern even though it is documentation-level rather than an executable exploit.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description is broadly scoped to trigger on many common finance-related queries, which can cause over-invocation and route users into a third-party integration unnecessarily. In context, that increases the chance of collecting credentials or sending sensitive financial queries to an external service when a native answer would suffice.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The skill explicitly tells the user to paste a live API key into the conversation, creating a clear risk of secret exposure through chat retention, telemetry, transcripts, or downstream agent memory. This is especially risky in the skill's stated indirect/IM deployment model, where the chat channel is not an appropriate secret-entry mechanism.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md

> 1. Open https://drillr.ai/developer/keys
> 2. Sign in — **Google sign-in is the quickest**; email/password also
>    works
> 3. Tap "Create API key" → give it a name (e.g. "my-agent") → copy
>    the `drl_...` string
> 4. Paste it back to me here. The key is shown only once.
>

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to have the user paste an API key into chat and then persist it to disk, but does not require an explicit up-front consent notice about local credential storage and chat exposure. In this context, the skill is more dangerous because it is designed for relayed/chat environments, where pasted secrets may be retained in logs and the user may not realize the key will be stored on the host machine.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

cat > ~/.config/drillr/config.json <<EOF { "api_key": "$KEY" } EOF chmod 600 ~/.config/drillr/config.json

text

**Step 3 — Verify the key works:**

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 385)May include surrounding context.

md

## Error handling

| HTTP | `code` string                | What to do                                                                                  |
| ---- | ---------------------------- | ------------------------------------------------------------------------------------------- |
| 400  | `invalid_body` / `invalid_query` / `invalid_id` | Fix parameter shape and retry (don't pester the user)                   |
| 401  | `unauthenticated` / `key_invalid` | Re-read the stored key; if still 401, rerun Prerequisites — the key is absent or wrong |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The script acknowledges the key is shown only once and asks the user to paste it into chat, then suggests deleting the message after confirmation. That pattern creates a false sense of safety because deletion from the visible chat does not guarantee removal from server-side logs, model context, or audit trails, creating persistence risk for a sensitive credential.

Content

Scanner excerpt · examples/user-onboarding-script.md (reported line 19)May include surrounding context.

md

> 1. Open https://drillr.ai/developer/keys
> 2. Sign in — **Google sign-in is the quickest**; email/password
>    also works
> 3. Tap "Create API key" → name it (e.g. "my-agent") → copy the
>    `drl_...` string
> 4. Paste it back to me here. The key is shown only once.
>

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The setup guidance tells users to persist the API key in shell startup files, which can leave long-lived credentials on disk in plain text and increase exposure to local compromise, backups, dotfile syncing, or accidental sharing. While this is common developer guidance, the lack of warnings or safer alternatives makes it a real secret-handling weakness.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.