build-on-base
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill includes behavioral directives in
references/agents/register.md(Phase 4) that attempt to establish permanent rules for the agent, specifically requiring that all future transactions include builder code attribution. - [PROMPT_INJECTION]: Detailed interactive workflows in
references/migrations/farcaster-miniapp-to-app.mddefine a wizard-like quiz flow that overrides the agent's default processing to enforce a specific diagnostic and path-selection routine. - [COMMAND_EXECUTION]: The skill provides several local scripts (
scripts/register.sh,scripts/analyze_project.py,scripts/validate_conversion.py) that perform network calls and local file analysis. These are intended to be executed by the agent to automate registration and migration tasks. - [INDIRECT_PROMPT_INJECTION]: The analysis scripts ingest project files and source code to identify migration needs, creating a surface where instructions embedded in external code could influence the agent's actions during the conversion process.
- [EXTERNAL_DOWNLOADS]: The
scripts/register.shscript makes POST requests tohttps://api.base.dev/v1/agents/builder-codes. This communication is directed to the vendor's official API for core functionality.
Audit Metadata