BaseCred

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:07 AM UTC
• Version: 1.0.0

Overview

The skill does what it advertises, but it loads all values from a discovered .env file and then runs an unpinned third-party SDK with access to those secrets.

Review this before installing. Run it only in a workspace whose .env contains no unrelated secrets, or provide just the required API keys through a tightly controlled environment. Pin and review the basecred-sdk version before use, since the documented install currently resolves the latest package at install time.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10
• Finding: Unpinned Third-Party SDK Is Dynamically Executed with Workspace Privileges<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:10`; related execution in `scripts/query.mjs:27-29` **Vulnerability Type**: Supply-chain exposure through an unpinned runtime dependency **Risk Level**: Medium ### Vulnerable Code `SKILL.md:10`: ```bash npm i basecred-sdk ``` `scripts/query.mjs:27-29`: ```js // Dynamic import so ESM resolution hits the right node_modules const sdkPath = path.join(WORKSPACE, 'node_modules', 'basecred-sdk', 'dist', 'index.js'); const { getUnifiedProfile } = await import(sdkPath); ``` ### Technical Analysis The installation instruction does not specify an exact, audited version of `basecred-sdk`, and the project does not contain a lockfile or integrity constraint. Consequently, the package version installed when a user follows the documented workflow can change after this Skill has been reviewed. The script subsequently imports the dependency's compiled entry point directly into the running Node.js process. Package initialization code and the exported `getUnifiedProfile` implementation therefore execute with the same filesystem, environment, user, and network privileges as the Skill. The SDK source is not included in the audited artifact, so its internal network destinations and handling of credentials cannot be independently verified here. This finding does not establish that the current SDK is malicious. It identifies a supply-chain boundary that permits a compromised or unexpectedly modified future package release to execute arbitrary code. ### Attack Path 1. A user follows the documented instruction and runs `npm i basecred-sdk`. 2. npm resolves a mutable package version because no exact version or project lockfile is specified. 3. An attacker compromises the package, its maintainer account, or a release process and publishes a malicious version. 4. The user invokes `scripts/query.mjs`. 5. The script locates and dynamically imports `basecred-sdk/dist/index.js`. 6. Malicious initialization or query code ...[truncated 880 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `basecred-sdk` to a reviewed exact version rather than installing the latest matching registry release. 2. Add and commit a package manifest and lockfile, then use `npm ci` in documented and automated workflows. 3. Enforce package integrity and provenance verification where supported. 4. Review the pinned SDK source, including initialization behavior, network destinations, and credential handling. 5. Keep automated dependency updates subject to security review and testing before deployment. 6. Consider executing the SDK in an isolated child process or restricted container. 7. If process isolation is used, provide only the wallet address and service-specific credentials required for the query, and restrict filesystem and network access to the minimum necessary. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/query.mjs:34
• Finding: Overbroad Ancestor .env Loading Exposes Unrelated Secrets to Third-Party Code<![CDATA[ ## Vulnerability Details **File Location**: `scripts/query.mjs:34-52`; required variables are selected at `scripts/query.mjs:62-63` **Vulnerability Type**: Excessive secret exposure and violation of least-privilege data handling **Risk Level**: Medium ### Vulnerable Code `scripts/query.mjs:34-52`: ```js function loadDotEnv() { let dir = process.cwd(); for (let i = 0; i < 5; i++) { const candidate = path.join(dir, '.env'); if (fs.existsSync(candidate)) { for (const line of fs.readFileSync(candidate, 'utf8').trim().split('\n')) { const eq = line.indexOf('='); if (eq === -1) continue; const key = line.slice(0, eq).trim(); const val = line.slice(eq + 1).trim(); if (!(key in process.env)) process.env[key] = val; } break; } dir = path.dirname(dir); } } loadDotEnv(); ``` `scripts/query.mjs:62-63` demonstrates that only two application-specific variables are used: ```js const talentKey = process.env.TALENT_PROTOCOL_API_KEY; const neynarKey = process.env.NEYNAR_API_KEY; ``` ### Technical Analysis The Skill only needs `TALENT_PROTOCOL_API_KEY` and, optionally, `NEYNAR_API_KEY`. Nevertheless, `loadDotEnv()` reads every assignment from the first `.env` file discovered while traversing as many as five directory levels upward and copies every parsed value into the global `process.env`. This behavior exceeds the minimum privileges required for a wallet-reputation query. An ancestor `.env` may contain unrelated database passwords, cloud credentials, signing keys, deployment tokens, or credentials belonging to a larger workspace. Once copied into `process.env`, these values become available to all code executing in the process, including the dynamically imported third-party SDK. The audited script does not directly transmit every loaded variable, and no confirmed exfiltration of unrelated credentials was found. The security issue is unnecessary secret exposure that substantiall ...[truncated 2032 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not copy arbitrary `.env` entries into `process.env`. 2. Read only the two explicitly required keys: ```js const ALLOWED_KEYS = new Set([ 'TALENT_PROTOCOL_API_KEY', 'NEYNAR_API_KEY', ]); // Parse the designated file, retaining only keys in ALLOWED_KEYS. ``` 3. Prefer credentials already supplied through the process environment or a dedicated secret manager. 4. Require an explicit `.env` path or restrict discovery to the intended workspace root; do not silently traverse ancestor directories. 5. Use a maintained dotenv parser if file-based configuration remains necessary, while still enforcing an allowlist. 6. Pass credentials directly through the SDK configuration without retaining unrelated values in global process state. 7. Isolate third-party SDK execution and provide a minimal environment containing only required variables. 8. Restrict outbound network access to documented service endpoints where the execution environment supports network controls. 9. Document that the public wallet address is transmitted to reputation providers and that each API key is supplied only to its intended service. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Credential Access

High

• Category: Privilege Escalation

Content

*
 * Usage:  node scripts/query.mjs <0x-address>
 *
 * Env (loaded from <workspace>/.env or shell):
 *   TALENT_PROTOCOL_API_KEY
 *   NEYNAR_API_KEY
 *

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

*
 * Usage:  node scripts/query.mjs <0x-address>
 *
 * Env (loaded from <workspace>/.env or shell):
 *   TALENT_PROTOCOL_API_KEY
 *   NEYNAR_API_KEY
 *

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

function loadDotEnv() {
  let dir = process.cwd();
  for (let i = 0; i < 5; i++) {
    const candidate = path.join(dir, '.env');
    if (fs.existsSync(candidate)) {
      for (const line of fs.readFileSync(candidate, 'utf8').trim().split('\n')) {
        const eq = line.indexOf('=');

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill instructs the agent to rely on workspace environment variables and execute a local Node.js script, but it does not declare any explicit tool scope or permissions boundary. That mismatch can cause an agent runtime to access secrets from `.env` or broader workspace resources without clear policy controls, increasing the risk of unintended secret exposure or overbroad execution.

Static analysis

No suspicious patterns detected.