skills/daaab/agent-skills/base-wallet/Gen Agent Trust Hub

base-wallet

Pass

Audited by Gen Agent Trust Hub on May 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides several Node.js scripts for managing wallets and interacting with blockchain services.
  • scripts/create-wallet.js: Generates new cryptographic identities and mnemonics.
  • scripts/basemail-register.js: Handles service registration using Ethereum signatures.
  • scripts/check-balance.js: Queries the blockchain for account balances.
  • [EXTERNAL_DOWNLOADS]: The skill makes network requests to legitimate infrastructure providers and vendor services.
  • Connects to official Base RPC nodes at mainnet.base.org and sepolia.base.org to interact with the blockchain.
  • Communicates with api.basemail.ai to facilitate email registration and management using Sign-In with Ethereum (SIWE).
  • [SAFE]: The skill implements significant security controls to protect the user's private keys.
  • Recommends the use of environment variables over file storage for sensitive information.
  • Explicitly sets restricted file permissions (0o600 for JSON wallets and 0o400 for mnemonics) when local storage is opted-in by the user.
  • Includes an audit logging mechanism in ~/.base-wallet/audit.log to track operations locally.
  • Features a safeguard in basemail-register.js that blocks execution if private keys are passed as command-line arguments to prevent shell history leakage.
Audit Metadata
Risk Level
SAFE
Analyzed
May 20, 2026, 04:41 PM
Security Audit — agent-trust-hub — base-wallet