ClawHub
Back to skill

Security audit

Dexscreener CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it can automatically install an unpinned global npm package with a package-name mismatch users should review first.

Install only if you are comfortable with a global npm package being added to your environment. Verify the intended package publisher/name first, prefer a pinned or local install, and require confirmation before allowing the agent to install or upgrade the CLI.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:9
Finding

Automatic Global Installation of an Unpinned Third-Party Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9-15
Vulnerability Type: Unpinned third-party dependency installed globally without integrity verification
Risk Level: Medium

Vulnerable Code

markdown
## Auto-Installation

The skill automatically installs `@kilincarslan/dexscreener-cli` if not found:

```bash
which dexscreener || npm install -g @kilincarslan-enterprises/dexscreener-cli
text

The declared package name and the package actually installed are inconsistent: the surrounding text specifies `@kilincarslan/dexscreener-cli`, while the command installs `@kilincarslan-enterprises/dexscreener-cli`.

### Technical Analysis

The skill instructs the agent to install the latest registry version of a third-party npm package globally. It does not pin an audited version, verify an integrity hash, disable npm lifecycle scripts, or require explicit user approval.

npm packages can execute lifecycle scripts during installation. Consequently, the effective code executed by this skill is not limited to the reviewed `SKILL.md`; it also includes mutable package content obtained from the npm registry. If the publisher account, package, registry delivery path, or a future release is compromised, installation can execute arbitrary code with the permissions of the npm process.

The discrepancy between the documented package scope and the installed package scope also creates a mistaken-package or dependency-confusion risk. Global installation further increases exposure by modifying the account's command environment outside a project-local dependency boundary.

### Attack Path

1. A user requests DexScreener market data.
2. The agent follows the skill and checks for a `dexscreener` executable.
3. If the executable is absent, the shell's `||` branch runs automatically.
4. npm resolves the unpinned current version of `@kilincarslan-enterprises/dexscreener-cli`.
5. A compromised or malicious package versio
...[truncated 664 chars]
Remediation
View remediation

Remediation Suggestions

  1. Use one consistent, verified package name in the metadata, documentation, and installation command.
  2. Pin the dependency to a specifically reviewed version rather than resolving the latest release.
  3. Verify package integrity using an approved lockfile and registry integrity metadata.
  4. Require explicit user confirmation before installing external software.
  5. Prefer a project-local dependency over npm install -g and invoke its verified local binary.
  6. Disable lifecycle scripts during installation where compatible, then review any scripts required for operation.
  7. Execute the CLI in a sandbox with minimal filesystem, credential, environment-variable, and network access.
  8. Consider querying the documented DexScreener API directly through a constrained HTTP client, removing the automatic package-installation path entirely.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises automatic global installation via npm install -g without warning that it will modify the host environment. Automatically installing and then trusting executable code from a registry is dangerous because it creates a clear supply-chain and persistence risk, especially in an agent context where users may not expect system-level changes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill metadata says it installs @kilincarslan/dexscreener-cli, but the documented auto-install command actually installs @kilincarslan-enterprises/dexscreener-cli. This package-name mismatch creates a supply-chain risk because users may trust one package while the skill fetches and executes another globally, making review, pinning, and provenance verification unreliable.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The activation guidance says to use the skill whenever a user asks for DexScreener data, which is broad enough to trigger on generic token, price, liquidity, or market-data requests. In a skill that can auto-install software and execute commands, broad activation increases the chance of unexpected tool execution and system modification without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.