Dex

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:29 AM UTC
• Version: 2.4.2

Overview

The skill is a coherent Dex CRM assistant, but its setup and authentication instructions grant broad local integration and persistent bearer-token access that users should review before installing.

Install only if you are comfortable giving Dex and configured AI clients access to CRM data, connected email metadata, and calendar operations. Prefer MCP browser OAuth or a single explicitly selected client, avoid unattended all-client setup, pin or review npm package versions where possible, and treat the local Dex token files as sensitive secrets that may need rotation or cleanup.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:25
• Finding: Unpinned npm packages are downloaded and executed during setup<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:25-29, 46-69` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: High ### Vulnerable Code ```yaml install: - id: 'npm' kind: 'node' package: '@getdex/cli' bins: ['dex'] label: 'Install Dex CLI (npm)' ``` ```bash npx -y add-mcp https://mcp.getdex.com/mcp -y ``` ```bash npm install -g @getdex/cli ``` ```bash npm install -g @getdex/cli@latest ``` ### Technical Analysis The setup instructions download and execute mutable npm packages without pinning them to an exact reviewed version or verifying package integrity. In particular, `npx -y add-mcp` automatically accepts installation and immediately runs the package. The global CLI installation likewise resolves whatever release is current at execution time, while `@latest` explicitly follows a mutable distribution tag. The package names are consistent with the declared Dex functionality, and the audited files contain no evidence that the current upstream packages are malicious. Nevertheless, the reviewed Skill does not determine the code that will ultimately execute. A compromised npm publisher account, registry response, dependency release, or future malicious package version could introduce arbitrary code after the Skill itself has passed review. Global installation also makes the resulting executable available beyond the current Skill invocation and potentially allows a compromised release to affect later sessions. ### Attack Path 1. An attacker compromises the npm account, release pipeline, package dependency, or registry content associated with `add-mcp` or `@getdex/cli`. 2. The attacker publishes a malicious version or changes the version selected by the mutable `latest` tag. 3. A user or agent follows the Skill setup instructions. 4. `npx -y add-mcp ...` downloads and immediately executes the attacker-controlled release, or npm globally installs the compromised CLI. 5. Package installation o ...[truncated 586 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every npm package to an exact reviewed version rather than using an omitted version or `@latest`. 2. Record and verify package integrity hashes or use a lockfile backed by an approved artifact repository. 3. Replace automatic `npx -y` execution with a process that displays the exact package name, resolved version, source, and affected files before requesting explicit approval. 4. Prefer a locally scoped installation over a global installation when the CLI only needs to support this Skill. 5. Audit the selected package and its dependency tree before updating the pinned version. 6. Treat updates as separate security-sensitive operations rather than automatically recommending the mutable latest release. 7. Where practical, distribute a signed, versioned binary and verify its signature or checksum before execution. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:46
• Finding: MCP setup modifies every detected AI client instead of the selected client<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:46-52` **Vulnerability Type**: Overbroad configuration access **Risk Level**: Medium ### Vulnerable Code ```markdown **Path A — Platform supports MCP (Claude Desktop, Cursor, VS Code, Gemini CLI, etc.):** If the user already has the Dex MCP server configured, or their platform can add MCP servers: ```bash npx -y add-mcp https://mcp.getdex.com/mcp -y ``` This auto-detects installed AI clients and configures the Dex MCP server for all of them. User authenticates via browser on first MCP connection. ``` ### Technical Analysis The declared objective is to make Dex available to the user, but the recommended setup command discovers and modifies all supported AI clients installed on the system. Enabling the integration in unrelated clients is not necessary when the user only intends to use Dex from the current client. This broad scope violates least privilege and expands the number of applications able to invoke the Dex integration. The operation is especially sensitive because configuration discovery and modification are delegated to an unpinned, remotely downloaded `add-mcp` package. The `-y` flags also reduce the opportunity to inspect or approve each client-specific modification. There is no evidence in the audited project that the command elevates to administrator or root privileges. The concern is unauthorized expansion within the invoking user's configuration and application trust boundaries. ### Attack Path 1. A user requests Dex setup in one AI client. 2. The agent or user runs the recommended `npx -y add-mcp ... -y` command. 3. The downloaded utility scans the system for multiple supported AI clients. 4. It writes the Dex MCP endpoint into every detected client configuration rather than only the active client. 5. Dex capabilities become available in applications and sessions that the user did not individually review or approve. 6. A prompt, extension, or user of one of those addition ...[truncated 563 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Configure only the current, explicitly selected AI client by default. 2. Enumerate detected clients and request separate, informed approval for each target. 3. Display the exact configuration file and proposed change before writing it. 4. Remove unattended `-y` behavior from security-sensitive configuration changes. 5. Back up configuration files and provide exact rollback instructions. 6. Document how to revoke Dex authorization and remove the MCP entry from each client. 7. Avoid delegating broad configuration writes to an unpinned package; use a reviewed, version-pinned installer or documented manual configuration. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:82
• Finding: Bearer credential is duplicated across two plaintext files and shared configuration handling is underspecified< (requires Professional plan) 2. Ask the user to save it in their own terminal, or write both files below from a local script that never prints the value 3. Destinations: `~/.dex/api-key` (chmod 600) **and** `~/.clihub/credentials.json` (chmod 600) ``` ```bash install -d -m 700 ~/.dex ~/.clihub umask 077 ``` ```markdown - `~/.dex/api-key` — raw `dex_…` bytes, mode `600`, no trailing commentary - `~/.clihub/credentials.json` — mode `600`, this schema (CLI source of truth): ```json { "version": 2, "servers": { "https://mcp.getdex.com/mcp": { "type": "bearer", "auth_type": "bearer_token", "token": "<api_key>" } } } ``` ``` ```markdown For CI/automation with no human present, use the API key method with `DEX_API_KEY` environment variable **and** the credentials file above. ``` ### Technical Analysis The Skill identifies `~/.clihub/credentials.json` as the current CLI source of truth but still directs the agent to store the same reusable bearer credential in `~/.dex/api-key`. This duplicates a sensitive secret and increases the number of locations that must be protected, excluded from backups, monitored, rotated, and securely deleted. The specified `0700` directory permissions, `0600` file permissions, restrictive `umask`, and warnings against printing credentia ...[truncated 2397 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store the bearer credential only in the location actually consumed by the current CLI. 2. If legacy compatibility requires `~/.dex/api-key`, make that duplicate explicitly opt-in and explain which legacy consumer needs it. 3. Prefer an operating-system credential manager or hardware-backed secret store over plaintext files. 4. Parse the existing CLIHub JSON, update only the Dex server entry, and preserve all unrelated fields and server credentials. 5. Perform writes atomically by creating a protected temporary file in the same directory, validating its JSON and mode, and then renaming it into place. 6. Refuse to proceed when ownership or permissions on the credential directory or existing file are unsafe. 7. Never place the token in command-line arguments, chat, logs, displayed tool parameters, shell history, or diagnostic output. 8. Avoid requiring simultaneous environment-variable and file copies in CI. Use the CI platform's secret injection mechanism and the minimum credential representation supported by the CLI. 9. Document token revocation, rotation, cleanup of both legacy and current locations, and verification that backups do not retain unnecessary copies. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (111)

Credential Access

High

• Category: Privilege Escalation

Content

**Where credentials actually live:**

- `@getdex/cli` reads `~/.clihub/credentials.json` (`auth_type: bearer_token`, `token: dex_…`).
- Some docs and older agents only write `~/.dex/api-key`. That file is **not** what the CLI sends on MCP calls.
- After device-code or API-key setup, write **both** files, or the next `dex …` call will 401.

• Confidence: 91% confidence
• Finding: The skill contains detailed instructions to read and write bearer credentials in `~/.clihub/credentials.json`, including the token schema and storage path. In an agent context, any workflow that handles raw long-lived tokens creates a real secret-exposure risk through tool logs, chat transcripts, local file access, or unintended reuse by other processes.

Credential Access

High

• Category: Privilege Escalation

Content

1. User generates a key at [Dex Settings > Integrations](https://getdex.com/appv3/settings/api) (requires Professional plan)
2. Ask the user to save it in their own terminal, or write both files below from a local script that never prints the value
3. Destinations: `~/.dex/api-key` (chmod 600) **and** `~/.clihub/credentials.json` (chmod 600)

**Option 2 — Device Code Flow (works on remote/headless machines):**

• Confidence: 91% confidence
• Finding: This section instructs writing the API key to both `~/.dex/api-key` and `~/.clihub/credentials.json`. Duplicating a long-lived credential across multiple files increases the attack surface and persistence of compromise if the endpoint, tool logs, or another local process can access those paths.

Credential Access

High

• Category: Privilege Escalation

Content

```

   - `~/.dex/api-key` — raw `dex_…` bytes, mode `600`, no trailing commentary
   - `~/.clihub/credentials.json` — mode `600`, this schema (CLI source of truth):

   ```json
   {

• Confidence: 94% confidence
• Finding: The embedded JSON schema explicitly shows where the bearer token is stored and how it is represented, making it straightforward for an agent or local process to persist and potentially leak a reusable authentication secret. In a CRM skill with access to contacts, notes, emails, and calendars, compromise of that token could expose sensitive relationship and communication data.

Credential Access

High

• Category: Privilege Escalation

Content

If the execution surface cannot keep the successful `/device/token` response out of chat or tool logs, stop and ask the user to finish in their own terminal.

5. Verify with `dex dex-list-tags` (or another read). If that 401s, `~/.clihub/credentials.json` was not updated.

There is no `dex auth login` subcommand in current `@getdex/cli` (1.0.x) even if some READMEs mention it. Use this HTTP device flow.

• Confidence: 88% confidence
• Finding: Even though this section warns about not exposing the `/device/token` response, it still directs the workflow around a successful token exchange and local credential persistence. The context makes clear the author is trying to reduce leakage, but the skill still enables secret handling in an execution surface that may not adequately isolate logs or transcripts.

Ae1

High

• Category: analysis-evasion

Content

See **[CLI Command Reference](references/cli-commands.md)** for the full mapping table of all 53 tools to CLI commands.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

See **[CLI Command Reference](references/cli-commands.md)** for the full mapping table of all 53 tools to CLI commands.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Where credentials actually live:**

- `@getdex/cli` reads `~/.clihub/credentials.json` (`auth_type: bearer_token`, `token: dex_…`).
- Some docs and older agents only write `~/.dex/api-key`. That file is **not** what the CLI sends on MCP calls.
- After device-code or API-key setup, write **both** files, or the next `dex …` call will 401.

**Cloudflare:** every request to `mcp.getdex.com` must send `User-Agent: dex-cli`. Bare `curl` with no UA returns Cloudflare **1010** (`browser_signature_banned`). That is not an expired code and not a Dex 401.

• Confidence: 90% confidence
• Finding: This duplicate finding refers to the same persistence behavior: storing API keys in durable files for future CLI use. While operationally convenient, it creates recoverable session state that can be harvested later by other tools, malware, or an over-privileged agent session.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Where credentials actually live:**

- `@getdex/cli` reads `~/.clihub/credentials.json` (`auth_type: bearer_token`, `token: dex_...`).
- Some docs and older agents only write `~/.dex/api-key`. That file is **not** what the CLI sends on MCP calls.
- After device-code or API-key setup, write **both** files, or the next `dex ...` call will 401.

**Cloudflare:** every request to `mcp.getdex.com` must send `User-Agent: dex-cli`. Bare `curl` with no UA returns Cloudflare **1010** (`browser_signature_banned`). That is not an expired code and not a Dex 401.

• Confidence: 90% confidence
• Finding: This duplicate finding refers to the same persistence behavior: storing API keys in durable files for future CLI use. While operationally convenient, it creates recoverable session state that can be harvested later by other tools, malware, or an over-privileged agent session.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Cloudflare:** every request to `mcp.getdex.com` must send `User-Agent: dex-cli`. Bare `curl` with no UA returns Cloudflare **1010** (`browser_signature_banned`). That is not an expired code and not a Dex 401.

Never ask the user to paste an API key into chat. Do not print, log, commit, or include it in tool arguments that will be shown back to the user. `dex auth --token <key>` puts the secret on the process argv — do not run that from an agent.

**Option 1 — API Key:**

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

1. User generates a key at [Dex Settings > Integrations](https://getdex.com/appv3/settings/api) (requires Professional plan)
2. Ask the user to save it in their own terminal, or write both files below from a local script that never prints the value
3. Destinations: `~/.dex/api-key` (chmod 600) **and** `~/.clihub/credentials.json` (chmod 600)

**Option 2 — Device Code Flow (works on remote/headless machines):**

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

1. Request a device code:

   ```bash
   curl -s -X POST https://mcp.getdex.com/device/code \
     -H "Content-Type: application/json" \
     -H "Accept: application/json" \
     -H "User-Agent: dex-cli"

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

## Command Mapping

| MCP Tool                                    | CLI Command                                                                                                           |
| ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| `dex_search_contacts`                       | `dex dex-search-contacts --query "..."`                                                                               |
| `dex_list_contacts`                         | `dex dex-list-contacts --limit 100`                                                                                   |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

## Command Mapping

| MCP Tool                                    | CLI Command                                                                                                           |
| ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| `dex_search_contacts`                       | `dex dex-search-contacts --query "..."`                                                                               |
| `dex_list_contacts`                         | `dex dex-list-contacts --limit 100`                                                                                   |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

## Command Mapping

| MCP Tool                                    | CLI Command                                                                                                           |
| ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| `dex_search_contacts`                       | `dex dex-search-contacts --query "..."`                                                                               |
| `dex_list_contacts`                         | `dex dex-list-contacts --limit 100`                                                                                   |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| MCP Tool                                    | CLI Command                                                                                                           |
| ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| `dex_search_contacts`                       | `dex dex-search-contacts --query "..."`                                                                               |
| `dex_list_contacts`                         | `dex dex-list-contacts --limit 100`                                                                                   |
| `dex_get_contact`                           | `dex dex-get-contact --id "..."`                                                                                      |
| `dex_create_contact`                        | `dex dex-create-contact --first-name "..." --last-name "..."`                                                         |
| `dex_update_contact`                        | `dex dex-update-contact --id "..." --company "..."`                                                                   |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| MCP Tool                                    | CLI Command                                                                                                           |
| ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| `dex_search_contacts`                       | `dex dex-search-contacts --query "..."`                                                                               |
| `dex_list_contacts`                         | `dex dex-list-contacts --limit 100`                                                                                   |
| `dex_get_contact`                           | `dex dex-get-contact --id "..."`                                                                                      |
| `dex_create_contact`                        | `dex dex-create-contact --first-name "..." --last-name "..."`                                                         |
| `dex_update_contact`                        | `dex dex-update-contact --id "..." --company "..."`                                                                   |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| MCP Tool                                    | CLI Command                                                                                                           |
| ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| `dex_search_contacts`                       | `dex dex-search-contacts --query "..."`                                                                               |
| `dex_list_contacts`                         | `dex dex-list-contacts --limit 100`                                                                                   |
| `dex_get_contact`                           | `dex dex-get-contact --id "..."`                                                                                      |
| `dex_create_contact`                        | `dex dex-create-contact --first-name "..." --last-name "..."`                                                         |
| `dex_update_contact`                        | `dex dex-update-contact --id "..." --company "..."`                                                                   |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| MCP Tool                                    | CLI Command                                                                                                           |
| ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| `dex_search_contacts`                       | `dex dex-search-contacts --query "..."`                                                                               |
| `dex_list_contacts`                         | `dex dex-list-contacts --limit 100`                                                                                   |
| `dex_get_contact`                           | `dex dex-get-contact --id "..."`                                                                                      |
| `dex_create_contact`                        | `dex dex-create-contact --first-name "..." --last-name "..."`                                                         |
| `dex_update_contact`                        | `dex dex-update-contact --id "..." --company "..."`                                                                   |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| `dex_search_contacts`                       | `dex dex-search-contacts --query "..."`                                                                               |
| `dex_list_contacts`                         | `dex dex-list-contacts --limit 100`                                                                                   |
| `dex_get_contact`                           | `dex dex-get-contact --id "..."`                                                                                      |
| `dex_create_contact`                        | `dex dex-create-contact --first-name "..." --last-name "..."`                                                         |
| `dex_update_contact`                        | `dex dex-update-contact --id "..." --company "..."`                                                                   |
| `dex_complete_keep_in_touch`                | `dex dex-complete-keep-in-touch --contact-id "..."`                                                                   |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| `dex_search_contacts`                       | `dex dex-search-contacts --query "..."`                                                                               |
| `dex_list_contacts`                         | `dex dex-list-contacts --limit 100`                                                                                   |
| `dex_get_contact`                           | `dex dex-get-contact --id "..."`                                                                                      |
| `dex_create_contact`                        | `dex dex-create-contact --first-name "..." --last-name "..."`                                                         |
| `dex_update_contact`                        | `dex dex-update-contact --id "..." --company "..."`                                                                   |
| `dex_complete_keep_in_touch`                | `dex dex-complete-keep-in-touch --contact-id "..."`                                                                   |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| `dex_filter_contacts`                       | `dex dex-filter-contacts --company "..." --tags "Investor"`                                                           |
| `dex_add_related_contacts`                  | `dex dex-add-related-contacts --contact-id "..." --contact-ids "c1,c2"`                                               |
| `dex_remove_related_contacts`               | `dex dex-remove-related-contacts --contact-id "..." --contact-ids "c1"`                                               |
| `dex_list_tags`                             | `dex dex-list-tags`                                                                                                   |
| `dex_get_tag`                               | `dex dex-get-tag --tag-id "..."`                                                                                      |
| `dex_create_tag`                            | `dex dex-create-tag --name "..."`                                                                                     |
| `dex_update_tag`                            | `dex dex-update-tag --tag-id "..." --name "..."`                                                                      |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| `dex_remove_related_contacts`               | `dex dex-remove-related-contacts --contact-id "..." --contact-ids "c1"`                                               |
| `dex_list_tags`                             | `dex dex-list-tags`                                                                                                   |
| `dex_get_tag`                               | `dex dex-get-tag --tag-id "..."`                                                                                      |
| `dex_create_tag`                            | `dex dex-create-tag --name "..."`                                                                                     |
| `dex_update_tag`                            | `dex dex-update-tag --tag-id "..." --name "..."`                                                                      |
| `dex_delete_tag`                            | `dex dex-delete-tag --tag-id "..."`                                                                                   |
| `dex_add_tags_to_contacts`                  | `dex dex-add-tags-to-contacts --tag-ids "id1,id2" --contact-ids "c1,c2"`                                              |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| `dex_remove_related_contacts`               | `dex dex-remove-related-contacts --contact-id "..." --contact-ids "c1"`                                               |
| `dex_list_tags`                             | `dex dex-list-tags`                                                                                                   |
| `dex_get_tag`                               | `dex dex-get-tag --tag-id "..."`                                                                                      |
| `dex_create_tag`                            | `dex dex-create-tag --name "..."`                                                                                     |
| `dex_update_tag`                            | `dex dex-update-tag --tag-id "..." --name "..."`                                                                      |
| `dex_delete_tag`                            | `dex dex-delete-tag --tag-id "..."`                                                                                   |
| `dex_add_tags_to_contacts`                  | `dex dex-add-tags-to-contacts --tag-ids "id1,id2" --contact-ids "c1,c2"`                                              |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| `dex_delete_tag`                            | `dex dex-delete-tag --tag-id "..."`                                                                                   |
| `dex_add_tags_to_contacts`                  | `dex dex-add-tags-to-contacts --tag-ids "id1,id2" --contact-ids "c1,c2"`                                              |
| `dex_remove_tags_from_contacts`             | `dex dex-remove-tags-from-contacts --tag-ids "id1" --contact-ids "c1"`                                                |
| `dex_list_groups`                           | `dex dex-list-groups`                                                                                                 |
| `dex_get_group`                             | `dex dex-get-group --group-id "..."`                                                                                  |
| `dex_create_group`                          | `dex dex-create-group --name "..." --emoji "🚀"`                                                                      |
| `dex_update_group`                          | `dex dex-update-group --group-id "..." --name "..."`                                                                  |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Static analysis

No suspicious patterns detected.