The Agent Skills Directory

[SAFE]: The skill adheres to a strict security protocol where all state-modifying actions (such as sending funds, swapping tokens, or signing messages) require the agent to provide an approval URL for the user to visit and confirm in their Base Account wallet. This ensures user control over all private key operations.- [EXTERNAL_DOWNLOADS]: Fetches configuration, route quotes, and transaction metadata from several official protocol APIs and well-known services, including Uniswap, OpenSea, Balancer, KyberSwap, and Morpho. These operations are neutral and inherent to the functionality of a cross-protocol aggregator.- [REMOTE_CODE_EXECUTION]: Employs standard package managers like npx and uvx to execute official command-line tools and software development kits from established protocol repositories (e.g., @opensea/cli, @morpho-org/cli, and the Velodrome finance Sugar SDK). These are recognized industry tools for the tasks described.- [COMMAND_EXECUTION]: Contains instructions for the agent to run helper scripts in a Node.js or shell environment to perform necessary tasks like calldata encoding, SIWE message preparation, and cryptographic checksum calculations. These scripts are provided in plain text and are localized to the specific plugin's logic.- [CREDENTIALS_UNSAFE]: Includes several hardcoded API keys and Bearer tokens for services like Uniswap, GMGN, and o1.exchange. Documentation within the skill identifies these as shared or public tokens intended to facilitate easy access for all users of the Base MCP integration.- [DATA_EXFILTRATION]: Ingests potentially adversarial data from third-party feeds (such as token launch discovery feeds). The skill mitigates this risk by including prominent warnings about user-supplied metadata and requiring user verification of all transaction details before approval.

base-mcp