Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed paid Base blockchain helper that sends selected transaction details to a remote API only after user confirmation and does not sign or submit transactions itself.
Use this only when you are comfortable sharing the shown wallet or transaction fields with the named API operator and PayAI. Confirm the price and endpoint each time, and do not approve or sign any transaction unless the separate local verification and human confirmation steps match your intent.
The trigger list includes broad terms such as 'allowance', 'revoke', and 'ENS' that can match common user requests and cause this skill to activate unexpectedly. Unintended invocation increases the chance that wallet addresses, calldata, or payment prompts are introduced into conversations where the user did not specifically request this external paid service.
The skill instructs the agent to send POST requests containing potentially sensitive transaction-related fields to a third-party origin, and explicitly notes that the operator may log wallet, token, recipient, and calldata data. Even though the document includes consent and payment safeguards, this is still an external data transmission path that can expose user financial metadata and transaction intent to an untrusted remote service.
.eth only → matching $0.001 route.curl -sS -D - -X POST https://basetoolbox.cartonpliant.workers.dev/v1/base-gas \
-H 'content-type: application/json' -d '{}'