BasedAgents

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:22 AM UTC
• Version: 1.0.1

Overview

The skill appears purpose-aligned, but it installs and demonstrates mutable npm commands while also relying on a local signing keypair.

Install only if you are comfortable running the current BasedAgents npm packages with your user account. Prefer a pinned, reviewed package version, avoid running npm as administrator, keep the BasedAgents keypair out of project directories, restrict its file permissions, and treat it like a private signing credential.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:15

Finding

Execution of Mutable, Unpinned npm Packages

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:15-17, SKILL.md:46-50, and SKILL.md:78-82
Vulnerability Type: Unsafe third-party dependency execution
Risk Level: High

Vulnerable Code

SKILL.md:15-17:

json

"command": "npx",
"args": ["-y", "@basedagents/mcp@latest"]

SKILL.md:46-50:

sh

npm i -g basedagents
basedagents register

SKILL.md:78-82:

sh

npx basedagents scan lodash
npx basedagents scan @modelcontextprotocol/server-filesystem

Technical Analysis

The skill configures npx to download and execute @basedagents/mcp@latest with the -y option, which suppresses the installation confirmation. The latest tag is mutable, so the package executed by future users may differ from the version available when the skill was audited.

The documented global installation and scanning commands also reference basedagents without an exact version or integrity constraint. Consequently, npm resolves whichever release is current at execution time. A compromised maintainer account, malicious future release, or npm supply-chain compromise could therefore replace the reviewed behavior with attacker-controlled code.

The global installation recommendation increases exposure by making the downloaded executable available throughout the user's environment. No evidence establishes that the currently published packages are malicious; the vulnerability is the absence of reproducible dependency pinning and integrity verification.

Attack Path

1. An attacker compromises the relevant npm package, its publisher account, or the package publication pipeline.
2. The attacker publishes a malicious release and assigns it to latest, or otherwise causes the unversioned package name to resolve to the malicious release.
3. A user loads the MCP configuration or follows one of the documented installation or scanning commands.
4. npx -y downloads and executes the package withou ...[truncated 968 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @basedagents/mcp@latest with an explicitly reviewed, immutable version, such as @basedagents/mcp@1.2.3.
2. Pin every documented basedagents invocation to an exact version rather than relying on npm's current resolution.
3. Remove -y so unexpected installations are not accepted automatically.
4. Use a committed lockfile and npm integrity metadata to make dependency resolution reproducible.
5. Prefer a project-local installation over npm i -g, and execute the pinned local binary through an npm script.
6. Review package source, lifecycle scripts, ownership changes, and release provenance before upgrading.
7. Where practical, vendor or mirror approved package artifacts and verify their cryptographic hashes before execution.
8. Run the MCP server with least privilege, restricted filesystem access, and constrained network access.
9. Keep the signing keypair outside directories accessible to package tooling and apply restrictive file permissions.
10. Establish an explicit dependency-update process that requires security review before changing pinned versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill tells users to register an agent and set BASEDAGENTS_KEYPAIR_PATH to a local keypair file, but it does not explicitly warn that the private key material is sensitive. In a skill that enables messaging and signed operations, omission of key-handling precautions can lead users to expose, mis-store, or over-share credentials that authorize actions as their agent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs users to run npx basedagents scan lodash without pinning an exact package version. This causes execution of whatever version is current at runtime, creating a supply-chain risk if a malicious or compromised release is published or if resolution is otherwise tampered with.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The example npx basedagents scan @modelcontextprotocol/server-filesystem also executes an unpinned package version from the registry. Because this skill is specifically about agent registry and scanning workflows, users are likely to copy-paste these commands, increasing practical exposure to package substitution or malicious upstream updates.

Content

No source excerpt is available for this finding.