Bitpanda Official

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:22 PM UTC
• Version:
  0.1.1

Overview

This skill is a disclosed read-only Bitpanda account lookup tool, but it handles sensitive financial data and an API key.

Install only if you are comfortable letting the agent read your Bitpanda balances, portfolio, trades, and transaction records. Use the narrowest read-only API key available, keep BITPANDA_API_KEY out of chat, logs, screenshots, and shell history, and review financial outputs before sharing them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The documentation instructs users to provide a long-lived Bitpanda API key and use the skill to retrieve sensitive financial account data, but it does not include a clear privacy warning, data-handling notice, or guidance on limiting exposure. In an agent context, this can lead users to disclose account-access credentials and portfolio history without understanding the sensitivity of the data being accessed or stored.

VirusTotal

65/65 vendors flagged this skill as clean.