Security audit

base-gas

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about paid gas-data queries, but it needs review because it can spend from an AgentCash wallet and repeatedly uses an unpinned npm CLI.

Review before installing. Use only with a wallet balance you are comfortable spending from, verify the endpoint and price before each paid call, avoid automated polling, and prefer a pinned or otherwise verified AgentCash CLI version instead of @latest.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:18
Finding: Paid x402 requests can spend wallet funds without explicit per-request confirmation
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:18-23, 39-44, 52-53, 73-74, 89-90, 140-146
Vulnerability Type: Unconfirmed paid operation
Risk Level: Medium

Vulnerable Instructions

markdown
Call `GET /health` first (free) before paying for history endpoints. Use `npx agentcash@latest fetch` for the paid routes.

markdown
| Task | Endpoint | Price | Returns | |------|----------|-------|---------| | Current gas | `GET /gas` | $0.002 | Base fee, low/med/high priority tiers, cost estimate in ETH and USD | | Compare chains | `GET /gas/compare` | $0.01 | Base, OP, Arbitrum, Ethereum ranked cheapest first, cost in USD | | Historical trend | `GET /gas/history` | $0.01 | Time series, min/max/avg/median, cheap-or-expensive verdict | | Cheapest hours | `GET /gas/cheapest-window` | $0.02 | Hours to avoid, cheapest hour, savings vs the average hour and in USD | | Data coverage | `GET /health` | **free** | How much history has been collected so far |

bash
npx agentcash@latest fetch https://base-gas-x402-production.up.railway.app/gas

bash
npx agentcash@latest fetch https://base-gas-x402-production.up.railway.app/gas/compare

bash
npx agentcash@latest fetch "https://base-gas-x402-production.up.railway.app/gas/history?hours=24"

markdown
### Decide whether to transact now - [ ] Check the trend and verdict: `GET /gas/history?hours=24` - [ ] If `verdict` is `flat`, proceed and tell the user there is nothing to wait for - [ ] If `cheap`, proceed - [ ] If `expensive`, check whether waiting actually helps: `GET /gas/cheapest-window` ```bash npx agentcash@latest fetch "https://base-gas-x402-production.up.railway.app/gas/history?hours=24"

text
### Technical Analysis The Skill maps ordinary informational requests—such as checking current gas prices, comparing chains, or deciding whether to wait—to x402-protected endpoints. It directs the Agent to invoke `npx agentcash@latest fetch`, which can settle a payment from the ...[truncated 2229 chars]
Remediation: View remediation
Remediation Suggestions

Require explicit user confirmation immediately before every paid endpoint request.

Present the endpoint, network, recipient service, currency, exact advertised price, and maximum possible charge in the confirmation prompt.

Use a CLI-enforced payment ceiling such as an explicit --max-payment option if supported, rather than relying only on natural-language instructions.

Treat general requests for gas information as authorization to retrieve information, not as implicit authorization to spend funds.

Keep /health as the default first request, but clearly distinguish its coverage check from payment approval.

For multi-step workflows, obtain fresh approval before each additional paid endpoint unless the user has explicitly approved a bounded total budget.

Prefer a read-only or free data source when the user has not approved payment.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (14)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The manifest metadata declares npx as a required binary and the skill content repeatedly depends on agentcash via mutable npx execution, indicating the unsafe pattern is integral to normal use. In practice this means the skill's execution path depends on downloading and running unpinned code, which is a classic supply-chain risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The skill instructs users to run npx agentcash@latest fetch, which is not a pinned immutable version and will execute whatever package version is current at runtime. That creates a supply-chain risk: a compromised upstream package, malicious new release, or dependency hijack could lead to arbitrary code execution on the user's machine or in the agent environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This command uses npx agentcash@latest, causing dynamic package resolution and execution at the time the skill is followed. If the package or one of its dependencies is malicious or compromised, the user may execute attacker-controlled code before even reaching the intended API call.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The skill again instructs execution of npx agentcash@latest, which fetches and runs the latest available package version. In a security-sensitive context involving wallet/payment tooling, this raises the risk of arbitrary code execution, credential theft, or transaction manipulation if the upstream package supply chain is compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Running npx agentcash@latest here exposes users to the same mutable-package execution risk as elsewhere in the skill. Because the command is presented as a normal workflow step, users may trust and run it without realizing they are executing code that can change over time outside the skill author's control.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This unpinned npx agentcash@latest invocation enables remote code execution via mutable dependency resolution. Since the skill is intended to help with blockchain transaction decisions and paid x402 routes, compromise could affect both the host environment and any associated wallet/payment context.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The skill's historical-trend example relies on npx agentcash@latest, which permits silent behavior changes and malicious package substitution over time. This is especially dangerous in agent workflows, where commands may be copied into automated systems and executed non-interactively.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This workflow example includes unpinned execution of agentcash, preserving the same supply-chain and arbitrary-code-execution risk. Automation-oriented instructions amplify the danger because they encourage repeated use in scripts or agents, increasing blast radius if the package is compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The command at this line executes a latest-tag npm package rather than a known-good release. In an ecosystem adjacent to on-chain activity, this creates a meaningful risk of host compromise, wallet interception, or tampering with fetched results if a malicious release is published.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This repeated use of npx agentcash@latest is a true vulnerability because it executes mutable third-party code on demand. Repetition across the document normalizes unsafe execution patterns and increases the likelihood that users will adopt them broadly in manual and automated contexts.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The efficiency guidance still recommends npx-based dynamic execution indirectly through the documented pattern, reinforcing a mutable supply-chain dependency in a transactional toolchain. An attacker controlling the package release path could leverage trust in the skill to gain code execution across multiple environments.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The documentation instructs users to run npx agentcash@latest balance, which fetches and executes the latest published package version at runtime rather than a pinned, reviewed release. If the package or publishing pipeline were compromised, users could execute malicious code on their machine while checking wallet state.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The command npx agentcash@latest redeem YOUR_CODE executes the newest package version during a wallet-funding workflow, which increases supply-chain risk. Because this step is tied to account funding and credentials-like invite redemption, a compromised package could exfiltrate sensitive wallet or environment data or misdirect funds.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: Using npx agentcash@latest accounts causes code from the latest package release to run on demand, exposing users to unintended code changes or malicious package updates. In the context of retrieving deposit links and wallet addresses, compromise could lead to address substitution, phishing links, or leakage of wallet-related information.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Instructions

Remediation Suggestions

SkillSpector

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Static analysis