Sanctions Screening, KYB & AML Compliance

• Outcome: Pass
• Latest audit: Jun 21, 2026 at 2:05 PM UTC
• Version:
  1.0.1

Overview

This skill is a disclosed paid compliance-screening helper that calls GoCreative API endpoints and does not include hidden code, persistence, or unrelated access.

Before installing, make sure you are comfortable sending names, domains, wallet identifiers, or company details to GoCreative for screening and with x402 auto-payment in USDC for each request. Treat any PASS/WARN/BLOCK result as compliance input that may need human or policy review, not as the sole authority for sensitive onboarding, payment, or contracting decisions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The activation guidance is broad enough to encourage use for any decision about whether an entity is 'legit / safe / sanctioned,' which can cause the agent to invoke the skill in situations beyond strict compliance screening. That increases the chance of unnecessary data sharing to a third-party service and over-reliance on an external PASS/WARN/BLOCK verdict for sensitive operational decisions.

VirusTotal

63/63 vendors flagged this skill as clean.