Central de Deudores BCRA

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill appears purpose-aligned for checking BCRA debt records, but it handles sensitive tax identifiers and credit/debt information.

Before installing, consider whether you are comfortable using a skill that looks up public BCRA credit/debt information by tax ID. Use it only when the user has a legitimate reason to check that identifier, and be careful when sharing the returned financial details or using the optional non-BCRA web link.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

A person's or company's tax ID and credit/debt information may be queried through an external service and shown in the conversation.

Why it was flagged

The skill uses external services with a tax identifier and presents returned names, debt status, and rejected-check details. This is disclosed and purpose-aligned, but the information is sensitive.

Skill content

**Base URL**: `https://api.bcra.gob.ar` ... **Input**: CUIT/CUIL/CDI ... **Optional web interface**: `https://compara.ar/deudores/:cuit`

Recommendation

Use the skill only for legitimate, user-requested checks; verify the identifier before querying; avoid sharing results unnecessarily; prefer the official BCRA API unless intentionally using the optional third-party UI.