RSoft Agentic Bank

• Outcome: Pass
• Latest audit: May 28, 2026 at 12:48 PM UTC
• Version:
  1.7.0

Overview

This skill is a transparent testnet lending workflow that uses a payment wallet and a fixed external API, with privacy details users should still review.

Install only if you intend to use RSoft's Base Sepolia testnet lending service. Use a dedicated testnet wallet with limited funds, verify the payment skill separately, and review the returned pay_to address and repayment_amount before allowing any payment command. Be aware that wallet addresses, request IDs, and transaction hashes are sent to RSoft's API, and the artifact does not explain retention or sharing practices.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill directs agents to send wallet identifiers, loan metadata, repayment request IDs, and transaction hashes to a third-party API, but does not clearly disclose this data-sharing or its trust implications. In an agentic context, this can cause autonomous systems to exfiltrate operational financial metadata to an external service without informed consent or policy checks.

VirusTotal

54/54 vendors flagged this skill as clean.