ClawHub
Back to skill

Security audit

Base Wallet

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real wallet skill, but it needs Review because it handles wallet secrets and extends into BaseMail account, email, and credit-related capabilities with limited scoping.

Install only if you are comfortable with an agent-accessible tool that can create wallets, expose private keys or mnemonics, sign SIWE messages, contact BaseMail.ai, and write wallet files locally. Use a test or low-value wallet first, avoid CI/shared logs and .env files for real funds, and require explicit human approval before BaseMail registration, email actions, credit purchases, or blockchain transactions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill documentation demonstrates access to environment variables for private keys and outbound network use for RPC calls and BaseMail registration, but no permissions are declared. In an agent environment, undeclared access to secrets and network destinations reduces transparency and policy enforcement, especially because the skill handles high-value wallet credentials.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The skill claims a narrower wallet purpose, but the documentation also includes email-account registration via wallet signature, local storage of wallet-related metadata, and balance/network interactions not clearly reflected in the declared behavior. For a wallet skill, behavior mismatches are especially dangerous because users may authorize secret handling or signing under incomplete assumptions, enabling unintended account creation, data persistence, or broader network actions.

Description-Behavior Mismatch

High
Confidence
94% confidence
Finding
The file documents a full email service API, including registration, inbox access, message reading, and credit purchases, which materially exceeds the wallet-centric scope described by the skill metadata. This capability mismatch is dangerous because an agent or user could be induced to grant SIWE authentication and then perform unexpected messaging or account actions outside the declared purpose, increasing the risk of data access, exfiltration, and unintended spending.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
Inbox access, reading emails, and sending messages are sensitive communications capabilities that are not justified by a wallet or crypto-identity skill description. In this context, the mismatch makes the capability more dangerous because a wallet-trusting user may not expect message retrieval or outbound communication, enabling covert data access or transmission under the guise of wallet functionality.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The script performs an external account-registration action against BaseMail using the agent's wallet, which goes beyond the core wallet/signing/transaction functionality described in the skill metadata. This can cause unauthorized identity creation and linkage of an agent wallet to a third-party service, expanding data exposure and operational scope without clear user consent.

Description-Behavior Mismatch

Low
Confidence
81% confidence
Finding
The script mutates managed wallet metadata by writing BaseMail registration details back into the wallet file, introducing an undocumented persistent side effect. Although the stored fields are not highly sensitive by themselves, altering wallet records can create privacy leakage, unexpected coupling to a third-party service, and downstream trust issues for tools that assume wallet files only contain wallet-related state.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The send-email documentation lacks prominent warnings that message content will be transmitted to recipients and that external delivery may consume paid credits. This can lead to unintentional disclosure of sensitive information and unauthorized resource consumption, especially when used by autonomous agents that may act without strong human review.

Credential Access

High
Category
Privilege Escalation
Content
// Mode: --env (recommended)
  if (isEnv) {
    console.log('# 🔐 New Wallet Created');
    console.log('# Copy these lines to your shell or .env file:');
    console.log('');
    console.log(`export WALLET_ADDRESS="${wallet.address}"`);
    console.log(`export PRIVATE_KEY="${wallet.privateKey}"`);
Confidence
94% confidence
Finding
.env

Unpinned Dependencies

Low
Category
Supply Chain
Content
"balance": "node scripts/check-balance.js"
  },
  "dependencies": {
    "ethers": "^6.0.0"
  },
  "keywords": ["base", "ethereum", "wallet", "ai-agent", "siwe"],
  "license": "MIT"
Confidence
92% confidence
Finding
"ethers": "^6.0.0"

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/basemail-register.js:19

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/create-wallet.js:118

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:186