Central de Deudores BCRA

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:23 PM UTC
• Version: 1.0.0

Overview

The skill coherently queries a public Argentina central bank debtor API, but it handles sensitive credit data and recommends a third-party URL without enough privacy or authorization guardrails.

Install only if you are comfortable using it for authorized Argentina debtor-registry lookups. Treat CUIT/CUIL/CDI credit information as sensitive, avoid checking unrelated individuals without consent or legal basis, and do not use the optional compara.ar link unless you accept sharing the identifier with that third-party site.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:22
• Finding: Third-Party Disclosure of Fiscal Identifier Through Optional Web Interface## Vulnerability Details **File Location**: `SKILL.md`, lines 22 and 151 **Vulnerability Type**: Third-party privacy exposure **Risk Level**: Medium **Complete Code Snippets**: ```markdown - **Optional web interface**: `https://compara.ar/deudores/:cuit` (replace `:cuit` with the 11-digit CUIT/CUIL/CDI) ``` ```markdown 5. **If user prefers a UI**, share `https://compara.ar/deudores/:cuit` as a quick visual option ``` ### Technical Analysis The Skill instructs the agent to place a user's 11-digit CUIT, CUIL, or CDI directly into a URL hosted by `compara.ar`. This is an external service that is not identified as an official server in the supplied OpenAPI specification; that specification lists only `https://api.bcra.gob.ar`. Opening the generated URL transmits the fiscal identifier to the third-party server as part of the request path. It may consequently appear in server and proxy access logs, browser history, monitoring systems, analytics records, screenshots, copied links, and potentially referrer data. The URL also reveals that the identifier was used to access a debtor-report interface. The Skill does not explain the third party's relationship to BCRA, establish why disclosure is necessary, warn about URL-based identifier exposure, or require informed consent before constructing the link. ### Attack Path 1. A user supplies a CUIT, CUIL, or CDI while requesting credit information. 2. Following the documented workflow, the agent substitutes that identifier for `:cuit` in the `compara.ar` URL. 3. The agent presents the personalized URL to the user. 4. When the user opens it, the third party receives the fiscal identifier in the HTTP request path. 5. The identifier and the user's apparent interest in a debtor report may be retained or exposed through server logs, intermediary systems, browser history, analytics, or subsequent sharing. ### Impact Assessment This issue does not grant local ...[truncated 362 chars]
• Remediation: ## Remediation Suggestions 1. Remove the `compara.ar` link and use only the official BCRA API server documented in the supplied OpenAPI specification. 2. If the third-party interface must remain available, identify it explicitly as an unaffiliated external service and explain that opening it discloses the fiscal identifier in the URL. 3. Obtain explicit user consent before inserting a CUIT, CUIL, or CDI into any third-party URL. 4. Do not automatically open the URL or send a request to the third party. 5. Prefer an official interface or a design that does not place personal identifiers in URL paths or query strings. 6. Document the third party's privacy, retention, logging, and data-processing behavior before recommending it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill enables lookup of highly sensitive financial and credit-report data tied to a national identifier, but it does not instruct the agent to verify that the user is authorized to request that person's data or warn about privacy implications. This creates a real risk of privacy abuse, stalking, doxxing, or unauthorized profiling using CUIT/CUIL/CDI numbers.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill recommends a third-party web interface and tells the agent to substitute the user's 11-digit identifier into the URL, but it provides no warning that this discloses sensitive personal data to an external non-BCRA site. That can expose regulated financial-identification data to additional tracking, retention, or misuse outside the official public API context.

External Transmission

Medium

• Category: Data Exfiltration

Content

Returns the latest reported debt situation across all financial entities.

```bash
curl -s "https://api.bcra.gob.ar/centraldedeudores/v1.0/Deudas/20123456789"
```

**Response structure:**

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Returns the latest reported debt situation across all financial entities.

```bash
curl -s "https://api.bcra.gob.ar/centraldedeudores/v1.0/Deudas/20123456789"
```

**Response structure:**

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Returns the latest reported debt situation across all financial entities.

```bash
curl -s "https://api.bcra.gob.ar/centraldedeudores/v1.0/Deudas/20123456789"
```

**Response structure:**

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The title and description are presented only in Spanish, and the rest of the API naming also assumes a Spanish-speaking user. Under the policy provided, forcing a specific language without user opt-in is a natural-language policy concern unless the locale constraint is clearly documented and justified.

Static analysis

No suspicious patterns detected.