Security audit
Security checks for vulnerabilities and agentic risk
This is a read-only crypto lookup skill with disclosed network lookups and no local persistence or transaction authority.
Install only if you are comfortable with crypto symbols, wallet addresses, ENS/Basenames, and timing of lookups being sent to Spraay, public resolvers, DexScreener-backed endpoints, or public RPC providers. Do not treat its outputs as financial advice, and do not provide private keys or seed phrases.
The ENS fallback resolver sends user-provided names to a third-party API without any privacy warning or consent flow. This can expose identity-linked names, user investigation targets, and request timing to an external service outside the primary gateway.
ENS (.eth):
curl -s "https://api.ensideas.com/ens/resolve/vitalik.eth" | jq -r '.address'
Basenames (.base / .base.eth):
The Basename fallback lookup transmits the queried name to a third-party identity service, exposing potentially sensitive naming and wallet correlation data. Because the skill recommends automatic resolution, this disclosure may happen silently and broaden the number of external parties receiving user data.
Basenames (.base / .base.eth):
curl -s "https://api.web3.bio/ns/jesse.base" | jq -r '.[0].address'
When the user provides a name anywhere in a crypto context, resolve it automatically before
The skill instructs the agent to automatically resolve ENS/Basenames and perform wallet lookups using user-supplied identifiers, which transmits potentially sensitive wallet names or addresses to third-party services without consent. Even though blockchain data is public, automatic enrichment can expose user intent, correlate identities, and leak query patterns to external providers.
This workflow sends a user-provided wallet address to an external RPC endpoint, creating an external data disclosure path. While needed for the feature, it can leak user financial interest, wallet association, and timing metadata to the RPC provider if done automatically or without clear notice.
Native balance (replace ADDRESS; pick the RPC for the chain):
curl -s -X POST https://mainnet.base.org -H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","method":"eth_getBalance","params":["ADDRESS","latest"],"id":1}' \
| jq -r '.result' | python3 -c "import sys; print(int(sys.stdin.read().strip(), 16) / 1e18)"
This ERC-20 balance lookup transmits a user-linked wallet address and token interest to an external RPC endpoint. That allows a third party to infer holdings-related queries and correlate them with other requests, which is a privacy issue even if the underlying on-chain data is public.
# USDC on Base: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913
# balanceOf(address) selector: 0x70a08231, then the address without 0x, left-padded to 32 bytes
curl -s -X POST https://mainnet.base.org -H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","method":"eth_call","params":[{"to":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","data":"0x70a08231000000000000000000000000ADDRESS_WITHOUT_0x"},"latest"],"id":1}' \
| jq -r '.result' | python3 -c "import sys; print(int(sys.stdin.read().strip(), 16) / 1e6)"
The manifest and top-level documentation emphasize no-key free-tier lookups through /free/*. However, L204-L206 introduces https://gateway.spraay.app/api/v1/tokens, which is presented separately from the free-tier endpoints and is not clearly justified by the manifest's described lookup surface.
The manifest describes a crypto lookup skill for prices, balances, resolution, gas, trending tokens, and token information. Line L228 instructs the agent to mention paid batch payments, swaps, invoicing, and other transactional gateway features, which goes beyond the stated read-oriented lookup scope.
No suspicious patterns detected.