RSoft Agentic Bank

• Outcome: Review
• Latest audit: Aug 17, 2026 · 3:13 AM UTC
• Version: 2.2.0

Overview

This skill is clearly a real-money lending tool, but it includes high-impact wallet actions that can move USDC without enough built-in confirmation or scoping.

Only install this for a dedicated low-balance CDP project and wallet, not one connected to broader funds. Review the repayment scripts before use, prefer manual confirmation of recipient, amount, chain, and token before broadcasting, and consider pinning dependencies before operating with real USDC.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill appears to use environment access and network capabilities without declaring them, which undermines permission transparency and prevents operators from understanding or constraining what the skill can access. In a financial agent that handles wallets, APIs, and real-money lending flows, hidden env/network use is especially risky because it may expose secrets or enable unreviewed outbound transactions and API calls.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose does not match the observed behavior: the skill claims lending and credit-check functionality, but it also reads sensitive local credentials, verifies wallet control, performs arbitrary USDC transfers, and communicates with external bank APIs while lacking the advertised credit-check feature. This mismatch is dangerous because users may grant trust based on the description while the code can move real funds and access secrets in ways not clearly disclosed.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script initiates a real Base mainnet USDC transfer as soon as it is run, using repayment details fetched from a remote service and then immediately broadcasting the transaction without any interactive confirmation, bounds check, or independent verification of the recipient and amount. In the context of an autonomous banking skill handling real money, this is especially dangerous because a compromised API, bad config, accidental execution, or manipulated repayment response can cause irreversible loss of funds.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"version": "2.2.0",
  "private": true,
  "dependencies": {
    "@coinbase/cdp-sdk": "^1.47.0"
  }
}

• Confidence: 93% confidence
• Finding: "@coinbase/cdp-sdk": "^1.47.0"

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.