base-mcp

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.78). Outsider free text is ingested via runtime HTTP responses from third-party APIs (e.g., api.bankr.bot, www.clawn.ch, api.bitrefill.com, aggregator-api.kyberswap.com, etc.) that the skill reads with web_request and then forwards into the agent’s reasoning context (e.g., product/token names, descriptions, error messages, and other string fields), which can include adversarial text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent to fetch remote conversational rules at runtime from https://docs.base.org/ai-agents/skills/references/tone.md (used to control tone/instructions), and the Aerodrome plugin runs the Sugar CLI via uvx --from "git+https://github.com/velodrome-finance/sugar-sdk.git@v0.4.0" which fetches and executes remote code at runtime, so both are runtime external dependencies that directly control prompts or execute code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provides wallet and on-chain transaction capabilities: it mentions the user has a Base Account wallet and can "check balances, send and swap tokens, sign messages, make x402 payments, batch contract calls" and exposes plugins for DeFi and trading (Morpho, Moonwell, Uniswap, Avantis, Aerodrome, Bankr, etc.) that perform swaps, deposits/withdrawals, borrow/repay, open/close positions, buy tokens, stake/claim rewards, and other write/transaction actions. These are specific, purpose-built financial execution functions (sending funds, executing trades, signing transactions), not generic tooling, so the skill grants direct financial execution authority.