base-mcp

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly fetches runtime instruction content from https://docs.base.org/ai-agents/skills/references/tone.md (used as a fallback to load conversation-wide tone/rules that directly control agent behavior) and the Aerodrome plugin runs the Sugar CLI via uvx using SUGAR_SPEC=git+https://github.com/velodrome-finance/sugar-sdk.git@v0.4.0 (a git+https package that is fetched and executed at runtime), so both are runtime external dependencies that control prompts or execute remote code.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill text for literal, high-entropy credentials that would grant direct access.

Flagged:

• The GMGN plugin includes a literal API key header value:
• "X-APIKEY: gmgn_basesolbscethmonadtron" This is a concrete API key string (not a placeholder) used to authenticate requests to openapi.gmgn.ai, so it is a real credential present in the doc.

Ignored (not flagged) and why:

• Any 0x addresses and contract addresses (e.g., token contracts, router addresses, Permit2 canonical address, burn / dead addresses). These are public on-chain addresses, not secrets.
• Placeholder tokens and environment variable examples (e.g., SUGAR_RPC_URI_8453, SUGAR_SDK_REF, UV_TOOL_DIR), and example JSON envelopes — documentation examples, not real secrets.
• SIWX and other protocol parameter examples, sample tx hashes, sample UUIDs/timestamps, and other example values — these are documentation/test values and not high-entropy credentials.
• Public or canonical constants (e.g., PERMIT2 address "0x000000000022D473030F116dDEE9F6B43aC78BA3") — these are well-known public addresses, not secrets.

Because the GMGN API key is a direct literal used for auth and appears usable as-is for their API, I mark the document as containing a real credential.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The Base MCP skill explicitly exposes wallet and on-chain transaction capabilities: it mentions the user has a Base Account wallet and can "check balances, send and swap tokens, sign messages, make x402 payments, batch contract calls." The plugin catalog and tool descriptions include concrete, actionable financial operations (e.g., Uniswap, KyberSwap, o1.exchange, Balancer, GMGN — all for swaps and submitting calldata via send_calls; Moonwell, Morpho for lend/borrow/repay; Avantis for opening/closing leveraged positions; Bitrefill for purchases paid with USDC; OpenSea for NFT trades; and many plugins that prepare and submit transaction calldata). These are specific, purpose-built interfaces to move value (send transactions, execute swaps, place market actions, and update on-chain positions), not generic automation or generic HTTP callers. Therefore this skill grants direct financial execution authority.