Central de Deudores BCRA

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:23 PM UTC
• Version: 1.0.0

Overview

The skill coherently queries a public Argentina central bank debtor API, but it handles sensitive credit data and recommends a third-party URL without enough privacy or authorization guardrails.

Install only if you are comfortable using it for authorized Argentina debtor-registry lookups. Treat CUIT/CUIL/CDI credit information as sensitive, avoid checking unrelated individuals without consent or legal basis, and do not use the optional compara.ar link unless you accept sharing the identifier with that third-party site.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:22

Finding

Third-Party Disclosure of Fiscal Identifier Through Optional Web Interface

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22 and 151
Vulnerability Type: Third-party privacy exposure
Risk Level: Medium

Complete Code Snippets:

markdown

- **Optional web interface**: `https://compara.ar/deudores/:cuit` (replace `:cuit` with the 11-digit CUIT/CUIL/CDI)

markdown

5. **If user prefers a UI**, share `https://compara.ar/deudores/:cuit` as a quick visual option

Technical Analysis

The Skill instructs the agent to place a user's 11-digit CUIT, CUIL, or CDI directly into a URL hosted by compara.ar. This is an external service that is not identified as an official server in the supplied OpenAPI specification; that specification lists only https://api.bcra.gob.ar.

Opening the generated URL transmits the fiscal identifier to the third-party server as part of the request path. It may consequently appear in server and proxy access logs, browser history, monitoring systems, analytics records, screenshots, copied links, and potentially referrer data. The URL also reveals that the identifier was used to access a debtor-report interface.

The Skill does not explain the third party's relationship to BCRA, establish why disclosure is necessary, warn about URL-based identifier exposure, or require informed consent before constructing the link.

Attack Path

1. A user supplies a CUIT, CUIL, or CDI while requesting credit information.
2. Following the documented workflow, the agent substitutes that identifier for :cuit in the compara.ar URL.
3. The agent presents the personalized URL to the user.
4. When the user opens it, the third party receives the fiscal identifier in the HTTP request path.
5. The identifier and the user's apparent interest in a debtor report may be retained or exposed through server logs, intermediary systems, browser history, analytics, or subsequent sharing.

Impact Assessment

This issue does not grant local ...[truncated 362 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the compara.ar link and use only the official BCRA API server documented in the supplied OpenAPI specification.
2. If the third-party interface must remain available, identify it explicitly as an unaffiliated external service and explain that opening it discloses the fiscal identifier in the URL.
3. Obtain explicit user consent before inserting a CUIT, CUIL, or CDI into any third-party URL.
4. Do not automatically open the URL or send a request to the third party.
5. Prefer an official interface or a design that does not place personal identifiers in URL paths or query strings.
6. Document the third party's privacy, retention, logging, and data-processing behavior before recommending it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill enables lookup of highly sensitive financial and credit-report data tied to a national identifier, but it does not instruct the agent to verify that the user is authorized to request that person's data or warn about privacy implications. This creates a real risk of privacy abuse, stalking, doxxing, or unauthorized profiling using CUIT/CUIL/CDI numbers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill recommends a third-party web interface and tells the agent to substitute the user's 11-digit identifier into the URL, but it provides no warning that this discloses sensitive personal data to an external non-BCRA site. That can expose regulated financial-identification data to additional tracking, retention, or misuse outside the official public API context.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

Returns the latest reported debt situation across all financial entities.

bash

curl -s "https://api.bcra.gob.ar/centraldedeudores/v1.0/Deudas/20123456789"

Response structure:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

Returns the latest reported debt situation across all financial entities.

bash

curl -s "https://api.bcra.gob.ar/centraldedeudores/v1.0/Deudas/20123456789"

Response structure:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

Returns the latest reported debt situation across all financial entities.

bash

curl -s "https://api.bcra.gob.ar/centraldedeudores/v1.0/Deudas/20123456789"

Response structure:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The title and description are presented only in Spanish, and the rest of the API naming also assumes a Spanish-speaking user. Under the policy provided, forcing a specific language without user opt-in is a natural-language policy concern unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.