base-mcp

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The Bankr plugin fetches public token launches from api.bankr.bot, which contains user-submitted free text (deployer handles, website links, token names/symbols) that an outsider can author and publish.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I have scanned the files in the documentation for hardcoded secrets, API keys, private keys, or high-entropy tokens.
• In plugins/uniswap.md, line 28, there is a string NeoYO3V50_koJAipDEalYWbMO1XMaFPAQmpOm6_Npo0. This is explicitly documented in the header section as a shared API key header ("x-api-key": "NeoYO3V50_koJAipDEalYWbMO1XMaFPAQmpOm6_Npo0"), which provides access to the Uniswap Trade API. It is a literal, high-entropy credential embedded in the documentation.
• All other cryptographic strings or addresses found (such as contract addresses like 0x833589... or block hashes) are public smart contract addresses or transaction hashes, not secrets.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill integrates the Base MCP server, providing direct financial execution operations such as sending tokens, swapping, signing, x402 payments, and batched contract calls (SKILL.md:3,33). These direct operations involve moving and trading real crypto assets via a connected Base Account wallet. While approval flows and external MCP server interaction are referenced (SKILL.md:49), there is no documented, independent access control or authentication enforced by the skill's own execution layer for these direct payment routes; access depends entirely on the underlying MCP tools and wallet state without an independent verification mechanism specified here.