base-wallet

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt instructs tools to generate and print private keys as environment-variable lines (e.g., export PRIVATE_KEY="0x..." and PRIVATE_KEY="0x..." node ...) and to copy/paste them into shells or .env files, which requires the agent to output secret values verbatim and therefore creates exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill's basemail-register.js explicitly fetches and parses responses from the public BaseMail API (https://api.basemail.ai), using untrusted fields like startData.message (which it signs) and auth/registration JSON (which it uses to decide registration, update wallet files, and obtain tokens), so third-party content from that API can directly influence tool actions and workflow.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The scripts (scripts/basemail-register.js) call https://api.basemail.ai at runtime to fetch a SIWE auth message which the agent/wallet signs (the fetched content directly controls the signed instruction and is required for registration), creating a high-risk external dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a crypto wallet for the Base/Ethereum ecosystem and provides programmatic wallet creation, private key/mnemonic management, RPC provider configuration, balance checks, message signing (SIWE) and, critically, code examples for sending transactions (connectedWallet.sendTransaction + tx.wait). These capabilities (creating/controlling wallets, holding private keys, and issuing blockchain transactions via an RPC) are direct mechanisms to move value on-chain. This matches the "Crypto/Blockchain (Wallets, Swaps, Signing)" and "Send Transaction" criteria for Direct Financial Execution.