build-on-base
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of local development tools and scripts. This includes Foundry commands (
forge create,cast wallet import) for smart contract management and bundled Python/Shell scripts for project analysis and agent registration. These operations are essential to the skill's primary purpose and are accompanied by explicit instructions to validate user-provided inputs (e.g., checking for shell metacharacters in contract paths or URLs). - [EXTERNAL_DOWNLOADS]: The skill references and interacts with several official and well-known services within the Base and Farcaster ecosystems. This includes network configuration for Base (Mainnet and Sepolia), the CDP (Coinbase Developer Platform) faucet and API, and the Base agent registration API (
api.base.dev). All remote references target established domains associated with the skill's stated functionality. - [DATA_EXFILTRATION]: During the agent registration process, the
register.shscript sends a user-provided wallet address to the Base registration API (https://api.base.dev/v1/agents/builder-codes). This is a transparent and intended data transfer required for the registration feature. - [CREDENTIALS_UNSAFE]: The skill provides best-practice guidance for managing sensitive information. It instructs users and agents to use Foundry's encrypted keystores for private keys and environment variables (.env files) for API keys, with explicit warnings never to commit these to version control.
Audit Metadata