ClawHub
Back to skill

Security audit

Base Alpha Scanner

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Base-chain market scanner that uses public crypto data APIs, with limited safety notes around broad routing and Basescan API-key handling.

Install only if you are comfortable with the skill sending token addresses and search terms to DexScreener, Basescan, GMGN, Clanker, Bankr, Virtuals, and related web pages. Use a dedicated, low-privilege Basescan API key, avoid putting it directly in shell history or shared CI logs, and treat its alerts as market research rather than trading advice.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/scan_base.py:286
Finding

Basescan API Key Exposed Through Command-Line Arguments and URL Query Parameters

Content
View full analysis
/cmdline`, or process-monitoring software. - Job runners, orchestration systems, terminal recordings, and diagnostic logs that record complete commands. - Support bundles or CI logs containing command invocations. The key is subsequently interpolated directly into a URL query string. Although the endpoint uses HTTPS and therefore encrypts the URL in transit, query parameters may still be retained by the destination service, HTTP client instrumentation, proxies, monitoring systems, exception reports, or application logs. This implementation also conflicts with `references/api-endpoints.md`, which identifies the `BASESCAN_API_KEY` environment variable as the expected key source. The script does not read that variable. No evidence was found that the script intentionally sends unrelated sensitive local information. Its network requests target fixed services that are directly relevant to the declared on-chain scanning functionality. The network b ...[truncated 1794 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The code substantially matches part of the declared purpose: it performs Base-chain token scanning, early-launch/second-wave filtering, token deep dives, holder distribution analysis via Basescan, and some GMGN-related data retrieval. However, the description claims several additional capabilities that are not present in the supplied code, including Clanker/Bankr.fun deployment scanning, VIRTUAL Protocol monitoring, AI narrative scanning, and trade alert generation. Also, the GMGN function is weaker than described because it fetches a generic ranking endpoint rather than clearly analyzing the specific token address passed in. So while the script aligns with the general Base alpha analysis theme, the declared description materially overstates the implemented functionality.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

The code does match part of the description: it scans Clanker and Bankr.fun, monitors VIRTUAL-related launches, and runs an AI narrative scanner on Base. However, the declared purpose is much broader than the implemented behavior. The script does not perform holder analysis, smart money flow tracking, generalized on-chain analysis, or alerting, and it does not cover mainstream assets like BTC/ETH/UNI. Its true scope is a narrow CLI-based narrative-token scanner using public web APIs and DexScreener searches, not a comprehensive Base alpha intelligence skill. Therefore the description materially overstates the actual capabilities.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill describes workflows that rely on network-capable scripts and external web resources, but it does not declare any explicit tool scope or permissions. That creates an authorization and governance gap: an orchestrator may invoke networked behavior without clear policy boundaries, making unexpected outbound access harder to audit or restrict.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The invocation description is extremely broad, including 'any on-chain analysis task on Base chain,' which can cause the orchestration layer to select this skill for many unrelated requests. Over-broad routing increases the chance of unnecessary network calls, use of the wrong data sources, and execution outside the author's intended safety envelope.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-endpoints.md (reported line 28)May include surrounding context.

md
from datetime import datetime, timezone

DEXSCREENER_BASE = "https://api.dexscreener.com"
BASESCAN_API = "https://api.basescan.org/api"
GMGN_BASE = "https://gmgn.ai/defi/quotation/v1"

def fetch_json(url, headers=None):

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/scan_base.py (reported line 22)May include surrounding context.

python
from datetime import datetime, timezone

DEXSCREENER_BASE = "https://api.dexscreener.com"
BASESCAN_API = "https://api.basescan.org/api"
GMGN_BASE = "https://gmgn.ai/defi/quotation/v1"

def fetch_json(url, headers=None):

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/scan_base.py (reported line 220)May include surrounding context.

python
from datetime import datetime, timezone

DEXSCREENER_BASE = "https://api.dexscreener.com"
BASESCAN_API = "https://api.basescan.org/api"
GMGN_BASE = "https://gmgn.ai/defi/quotation/v1"

def fetch_json(url, headers=None):

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/scan_narrative.py (reported line 128)May include surrounding context.

python
# Bankr API endpoints
    endpoints = [
        "https://api.bankr.bot/tokens/trending?chain=base&limit=20",
        "https://bankr.fun/api/tokens?chain=base&sort=trending&limit=20",
        "https://api.bankr.fun/v1/tokens/trending?chain=base",
    ]

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/scan_narrative.py (reported line 130)May include surrounding context.

python
endpoints = [
        "https://api.bankr.bot/tokens/trending?chain=base&limit=20",
        "https://bankr.fun/api/tokens?chain=base&sort=trending&limit=20",
        "https://api.bankr.fun/v1/tokens/trending?chain=base",
    ]

    data = {"error": "not tried"}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-endpoints.md (reported line 80)May include surrounding context.

md
print("⚡ VIRTUAL Protocol — AI Agent Ecosystem\n")

    # Virtual Protocol API
    url = "https://api.virtuals.io/api/virtuals?filters[status]=DEPLOYED&sort[0]=createdAt%3Adesc&pagination[page]=1&pagination[pageSize]=20"
    data = fetch_json(url)

    if "error" in data:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/scan_narrative.py (reported line 167)May include surrounding context.

python
print("⚡ VIRTUAL Protocol — AI Agent Ecosystem\n")

    # Virtual Protocol API
    url = "https://api.virtuals.io/api/virtuals?filters[status]=DEPLOYED&sort[0]=createdAt%3Adesc&pagination[page]=1&pagination[pageSize]=20"
    data = fetch_json(url)

    if "error" in data:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/scan_narrative.py (reported line 174)May include surrounding context.

python
print(f"Virtual API error: {data['error']}")
        # Fallback: DexScreener search for VIRTUAL pairs
        print("Falling back to DexScreener VIRTUAL pairs...\n")
        url2 = "https://api.dexscreener.com/latest/dex/tokens/0x0b3e328455c4059EEb9e3f84b5543F74E24e7E1b"
        data2 = fetch_json(url2)
        pairs = [p for p in data2.get("pairs", []) if p.get("chainId") == "base"]
        print(f"Found {len(pairs)} VIRTUAL pairs on Base:\n")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/scan_narrative.py (reported line 213)May include surrounding context.

python
print(f"Virtual API error: {data['error']}")
        # Fallback: DexScreener search for VIRTUAL pairs
        print("Falling back to DexScreener VIRTUAL pairs...\n")
        url2 = "https://api.dexscreener.com/latest/dex/tokens/0x0b3e328455c4059EEb9e3f84b5543F74E24e7E1b"
        data2 = fetch_json(url2)
        pairs = [p for p in data2.get("pairs", []) if p.get("chainId") == "base"]
        print(f"Found {len(pairs)} VIRTUAL pairs on Base:\n")

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The document uses natural-language instructions that hard-code a specific recipient/persona ("directing ZHAO") rather than presenting the behavior as optional or configurable. This can be a policy-style natural-language constraint because it forces a specific handling path without user opt-in or justification in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The heading "ZHAO's rules" and the subsequent directives prescribe a specific recipient context in natural language. Because the file does not indicate that this audience is optional, user-selected, or operationally required, it creates a policy-style constraint embedded in documentation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.