Fintechblocks

• Outcome: Review
• Latest audit: May 29, 2026 at 9:36 PM UTC
• Version:
  1.0.2

Overview

This FintechBlocks integration appears coherent, but it gives an agent broad authenticated access to a fintech API with insufficient limits and user-confirmation guidance.

Install only if you intend to let the agent work with your FintechBlocks account through Membrane. Before using it, require explicit confirmation for any create, update, delete, or raw proxy request, and avoid sending unnecessary personal, financial, credential, or customer data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The description is broad enough to trigger on generic requests about managing data, records, or workflows, which could cause the agent to invoke this external-integration skill when the user did not clearly ask to interact with FintechBlocks. That increases the chance of unnecessary external actions or data exposure through an unintended third-party connection.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The proxy-request section encourages direct API requests but does not warn that request paths, bodies, query parameters, and headers may contain sensitive financial or identity data that will be transmitted to FintechBlocks. In a fintech context, omission of that warning makes accidental exfiltration or over-sharing more likely, especially when agents construct raw requests autonomously.

VirusTotal

65/65 vendors flagged this skill as clean.