Loan Qualification Check

• Outcome: Review
• Latest audit: Jul 24, 2026 · 1:01 AM UTC
• Version: 2.2.3

Overview

This loan-screening skill is not clearly malicious, but it needs review because it sends sensitive applicant data and a user key to a hardcoded plain-HTTP backend with limited privacy disclosure.

Before installing, treat this as a third-party SaaS integration for sensitive loan data. Do not use it with real applicants unless you trust the operator, have consent to send the data, understand retention and privacy terms, and can force a secure HTTPS endpoint. Also note that the published script currently appears broken due to a Python syntax error.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill requires environment variables and instructs the agent to call a backend API, but it does not declare explicit permissions for those capabilities. This creates a transparency and policy gap: users or the platform may not realize the skill can access secrets and make outbound network requests, which is especially sensitive in a financial screening workflow handling personal data. In context, the risk is elevated because the skill processes loan applicant information and could transmit it to an external server.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill’s stated purpose is loan prequalification, but it also implements account registration, billing/status lookup, and package/service marketing flows. Expanding scope beyond the declared function increases attack surface, creates unnecessary data handling paths, and can mislead users into interacting with external commercial services they did not explicitly intend to use.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The services command exposes a generic catalog of all backend AI services and pricing, which is unrelated to a narrowly scoped loan-check tool. This enables capability discovery against the backend and may reveal additional attack surface, internal business functions, or endpoints that users of this skill should not be probing.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger conditions are broad natural-language examples such as common questions about loan eligibility and amount, which can overlap with ordinary conversation. This can cause the skill to activate unexpectedly and collect or transmit sensitive financial and personal information to its backend without sufficiently deliberate user intent. The financial context makes accidental invocation more dangerous because users may reveal regulated or highly sensitive data during routine chat.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: This file presents detailed loan products, rates, and eligibility cues in a way that can be interpreted as actionable financial guidance, but it lacks clear warnings that offers vary by region, underwriting rules, borrower profile, and regulatory constraints. In the context of a loan prequalification skill, users may over-rely on the list and make financial decisions based on incomplete or outdated information, creating consumer harm and compliance risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script transmits sensitive financial profile data such as age, income, credit status, loan type, loan amount, and city to a remote backend without any explicit privacy notice, consent prompt, or explanation of how the data will be used. In the context of loan screening, this is especially sensitive because the data can materially affect lending decisions and may qualify as regulated personal financial information.

External Transmission

Medium

• Category: Data Exfiltration

Content

if method == "GET":
            resp = requests.get(url, headers=h, params=data or {}, timeout=30)
        else:
            resp = requests.post(url, headers=h, json=data or {}, timeout=60)
        if resp.status_code >= 400:
            try:
                err = resp.json()

• Confidence: 97% confidence
• Finding: The skill sends user data to an external backend, and the default API base is plain HTTP to a hardcoded IP address rather than HTTPS. This creates a serious risk of interception, tampering, or traffic redirection in transit, especially because the transmitted content includes financial profiling data and potentially an X-User-Key credential.

Static analysis

No suspicious patterns detected.