Dexscreener CLI

• Outcome: Review
• Latest audit: May 29, 2026 at 9:35 PM UTC
• Version:
  1.0.1

Overview

This skill is for DexScreener market-data lookup, but it automatically installs an unpinned third-party npm CLI globally before use.

Review before installing. The skill appears intended to query public crypto market data, but first use can install a third-party npm package globally. Verify the exact package name and publisher, consider installing a pinned version yourself, and only allow it if you are comfortable with persistent changes to your Node/npm environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to automatically run `npm install -g` for a third-party package and then execute the resulting CLI, but the description does not clearly warn the user that arbitrary external code may be installed and run on the host. This is dangerous because global package installation introduces supply-chain and execution risk, especially in an agent context where users may believe they are only performing a read-only API query.

VirusTotal

64/64 vendors flagged this skill as clean.