Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small, disclosed curl-based helper for checking L2 network health and optionally querying a caller-profiling passport endpoint.
Before installing, be aware that using the passport command sends request metadata to a third-party service for caller classification. Use the free delayed health check for normal transaction timing, and use the paid live endpoint only with an x402-capable wallet/tool you intend to charge.
The skill directs users to a third-party endpoint that explicitly profiles the caller using request timing and headers, which can expose behavioral fingerprints and identifying metadata without a prominent privacy warning or consent step. In an agent context, this may also leak infrastructure traits, automation patterns, and stable network identifiers to an external service.
The manifest description limits the network-health check feature to a specific set of L2s: Base, Arbitrum, Optimism, zkSync, Scroll, Linea, Blast, Mantle, Mode, Taiko, and Polygon zkEVM. The skill file's documented chain list additionally includes casper, which is outside that stated scope and changes what the skill claims to support.
No suspicious patterns detected.
