base-wallet
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides several Node.js scripts for managing wallets and interacting with blockchain services.
scripts/create-wallet.js: Generates new cryptographic identities and mnemonics.scripts/basemail-register.js: Handles service registration using Ethereum signatures.scripts/check-balance.js: Queries the blockchain for account balances.- [EXTERNAL_DOWNLOADS]: The skill makes network requests to legitimate infrastructure providers and vendor services.
- Connects to official Base RPC nodes at
mainnet.base.organdsepolia.base.orgto interact with the blockchain. - Communicates with
api.basemail.aito facilitate email registration and management using Sign-In with Ethereum (SIWE). - [SAFE]: The skill implements significant security controls to protect the user's private keys.
- Recommends the use of environment variables over file storage for sensitive information.
- Explicitly sets restricted file permissions (
0o600for JSON wallets and0o400for mnemonics) when local storage is opted-in by the user. - Includes an audit logging mechanism in
~/.base-wallet/audit.logto track operations locally. - Features a safeguard in
basemail-register.jsthat blocks execution if private keys are passed as command-line arguments to prevent shell history leakage.
Audit Metadata