XRPL Transaction Builder

• Outcome: Pass
• Latest audit: May 28, 2026 at 11:23 AM UTC
• Version:
  1.0.0

Overview

The skill is a small, transparent XRPL transaction helper, with the main risk being that signed blockchain transactions can affect real funds or account state.

Install only if you intend to create XRPL transactions. Treat every Xaman signature as authorizing a real ledger action: verify the destination, amount, destination tag, transaction type, NFT fields, issuer, flags, fees, and network before signing or submitting. Use testnet or devnet examples when experimenting, and consider pinning the xrpl npm dependency in real projects.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This skill encourages building, signing, and submitting XRPL transactions without clearly warning that these actions can irreversibly transfer funds, mint or burn NFTs, or alter account state on-chain. In a transaction-building skill, omission of this warning materially increases the chance of unsafe use, accidental loss of assets, or unintended account changes, especially if users copy examples directly into production workflows.

VirusTotal

66/66 vendors flagged this skill as clean.