abe-exchange-rates

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:42 PM UTC
• Version:
  1.0.0

Overview

This appears to be a currency-rate lookup skill with a transparency issue around fallback data sources, not evidence of malware or unsafe control of the user’s system.

Install only if informational exchange-rate lookup is acceptable for your use case. Do not rely on the output for compliance, accounting, trading, or source-specific pricing decisions unless the skill clearly reports which provider supplied each rate.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill advertises XE.com-sourced exchange rates, but if scraping fails it silently switches to a different provider. This is a real integrity and transparency issue because callers may rely on the stated source, pricing methodology, or legal/compliance characteristics of XE, while actually receiving data from another service without notice.

VirusTotal

64/64 vendors flagged this skill as clean.