Security audit
Security checks for vulnerabilities and agentic risk
This skill fetches Venezuelan exchange-rate data from disclosed public sources and does not show hidden access, persistence, credential use, or unrelated behavior.
Install this if you are comfortable with the skill making live web requests to BCV, Binance P2P, and a fallback exchange-rate API. Treat the output as market data that can fluctuate and verify rates independently before making financial decisions.
The skill documentation indicates network access to external domains (BCV, Binance P2P, and a fallback API) but does not declare any tool scope or permissions boundaries. This creates an authorization and governance gap: an agent may invoke network-capable code without explicit least-privilege constraints or user-visible approval semantics.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
BCV_URL = "https://www.bcv.org.ve/"
BINANCE_URL = "https://p2p.binance.com/bapi/c2c/v2/friendly/c2c/adv/search"
FALLBACK_URL = "https://api.exchangerate-api.com/v4/latest/USD"
UA = "Mozilla/5.0"
The description says to use the skill when the user asks for 'exchange rates in Venezuela,' which is broader and less specific than the other listed triggers. Without clearer scope boundaries or exclusion examples, this could cause unintended invocation for generic Venezuela-related exchange-rate questions not specifically about the BCV/USDT comparison use case.
This code file emits all user-facing messages in Spanish, including headings, warnings, and status output. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a reportable issue unless the locale restriction is explicitly justified.
No suspicious patterns detected.