Security audit
Security checks for vulnerabilities and agentic risk
This is a clearly described paid XMTP lead-generation skill, with disclosed payments, group access, monitoring, and invite behavior, but users should treat it as a high-impact commercial integration.
Install only if you intentionally want Basemate to participate in your XMTP group, process matched group-message activity through its service, send invite DMs to potential leads, and use USDC payments. Confirm the target group, per-human price, setup fee, cancellation process, and privacy/compliance terms before authorizing subscriptions or delivery claims.
The skill documents broad natural-language triggers like 'subscribe', 'buy humans', 'cph', and 'lead subscribe' for a DM-based workflow. In an agent setting, overly generic trigger phrases can be invoked accidentally from ordinary conversation or prompt-injected content, causing an agent to initiate a paid subscription flow or continue a sensitive workflow without clear user intent.
The skill emphasizes consent for joining groups, but it under-communicates that using the service depends on ongoing monitoring and automated message analysis across many XMTP groups to identify targets. That omission can mislead operators about the privacy, compliance, and reputational implications of subscribing, causing them to enable a workflow that processes third-party communications more broadly than expected.
The tool descriptions for discovery and subscription actions are broad and do not clearly constrain when the agent should invoke them, what user authorization is required, or what high-risk side effects must be confirmed first. In this skill, that ambiguity matters because some actions can trigger payments, subscriptions, and outreach/invitations to third parties, increasing the chance of unintended financial spend or spammy behavior if an agent over-interprets a user request.
No suspicious patterns detected.
