Ruofan Bargain Arena

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:23 PM UTC
• Version:
  2.1.0

Overview

This is a straightforward coupon-bargaining helper, but users should know their nickname and bargain messages go to Ruofan and may be shown publicly.

Before installing or using it, choose a non-sensitive nickname and only send messages you would be comfortable having sent to Ruofan and potentially displayed on an activity page. Treat the returned session token and coupon code as specific to this bargain session.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill sends user-provided nickname and bargaining messages to an external domain, but the instructions do not require an explicit upfront disclosure or consent prompt before transmission. Because the conversation is also described as publicly displayed on the event page, users may unknowingly submit personal or sensitive information to a third party and potentially to a public surface.

VirusTotal

64/64 vendors flagged this skill as clean.