Security audit
Security checks across malware telemetry and agentic risk
The skill has a coherent identity-registration goal, but the supplied code evidence shows broad wallet-signing and auto-approval behavior that could authorize actions outside that goal.
Install only if you are comfortable reviewing and constraining the wallet scripts first. Use a low-value or dedicated wallet, require interactive confirmations, verify every message and transaction before signing, and avoid connecting it to arbitrary dApps until contract, origin, calldata, and value allowlists are added.
resp = requests.post('https://api.basemail.ai/api/auth/start',
json={'address': wallet.address}).json()
sig = wallet.sign_message(encode_defunct(text=resp['message']))
auth = requests.post('https://api.basemail.ai/api/auth/agent-register',
json={'address': wallet.address, 'signature': sig.signature.hex(),
'message': resp['message']}).json()resp = requests.post('https://api.basemail.ai/api/auth/start',
json={'address': wallet.address}).json()
sig = wallet.sign_message(encode_defunct(text=resp['message']))
auth = requests.post('https://api.basemail.ai/api/auth/agent-register',
json={'address': wallet.address, 'signature': sig.signature.hex(),
'message': resp['message']}).json()// 2. Sign + Register (auto-detects your new Basename)
const signature = await account.signMessage({ message });
const { token, email } = await fetch('https://api.basemail.ai/api/auth/agent-register', {
method: 'POST', headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ address: account.address, signature, message, basename: fullName }),
}).then(r => r.json());// 2. Sign + Register (auto-detects your new Basename)
const signature = await account.signMessage({ message });
const { token, email } = await fetch('https://api.basemail.ai/api/auth/agent-register', {
method: 'POST', headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ address: account.address, signature, message, basename: fullName }),
}).then(r => r.json());-d '{"address":"YOUR_WALLET_ADDRESS"}'
# 3. Sign + Register
curl -X POST https://api.basemail.ai/api/auth/agent-register \
-H "Content-Type: application/json" \
-d '{"address":"...","signature":"0x...","message":"..."}'resp = requests.post('https://api.basemail.ai/api/auth/start',
json={'address': wallet.address}).json()
sig = wallet.sign_message(encode_defunct(text=resp['message']))
auth = requests.post('https://api.basemail.ai/api/auth/agent-register',
json={'address': wallet.address, 'signature': sig.signature.hex(),
'message': resp['message']}).json()console.log(`📍 Address: ${address}`);
console.log(`⛓️ Chain: ${config.chainId}`);
console.log(`🔗 RPC: ${config.rpc}`);
console.log(`🔐 Mode: ${config.interactive ? 'Interactive (prompt before signing)' : 'Auto-approve'}`);
if (config.audit) {
console.log(`📝 Audit: ${AUDIT_FILE}`);
}"connect": "node scripts/wc-connect.js"
},
"dependencies": {
"@walletconnect/core": "^2.0.0",
"@walletconnect/web3wallet": "^1.0.0",
"ethers": "^6.0.0",
"puppeteer": "^21.0.0"},
"dependencies": {
"@walletconnect/core": "^2.0.0",
"@walletconnect/web3wallet": "^1.0.0",
"ethers": "^6.0.0",
"puppeteer": "^21.0.0"
},"dependencies": {
"@walletconnect/core": "^2.0.0",
"@walletconnect/web3wallet": "^1.0.0",
"ethers": "^6.0.0",
"puppeteer": "^21.0.0"
},
"keywords": ["basename", "base", "ens", "web3", "ai-agent"],"@walletconnect/core": "^2.0.0",
"@walletconnect/web3wallet": "^1.0.0",
"ethers": "^6.0.0",
"puppeteer": "^21.0.0"
},
"keywords": ["basename", "base", "ens", "web3", "ai-agent"],
"license": "MIT"VirusTotal findings are pending for this skill version.
No suspicious patterns detected.