Identity certificates, public registry, and wishing well for AI agents — x402 micropayments on Base
Risky behavior the analysis could not rule out.
README tells users to reference a GitHub Action pinned to the mutable `@main` branch, so CI would run whatever code is currently on that branch.
uses: vinaybhosle/agentstamp/.github/actions/verify-agent@main
This is the same unpinned @main action reference as the previous finding. Nothing in the evidence pins it or mitigates it.
README tells users to consume a GitHub Action from the mutable `@main` ref rather than a pinned SHA or tag, so later upstream changes would run in the user's CI with access to the passed secret.
uses: vinaybhosle/agentstamp/.github/actions/verify-agent@main
The README tells users to run a GitHub Action from the mutable @main ref and pass a secret to it. The action lives in the project's own repo, but the ref is unpinned and no carve-out or mitigation applies. Severity is low.
The server fetches a registration URI controlled by arbitrary on-chain ERC-8004 token owners over HTTPS without blocking private or internal hostnames, so it could probe internal HTTPS endpoints (limited SSRF; redirects rejected, 512KB cap, https only).
const response = await fetch(url, {isSafeUri only checks the https scheme and does not block private or internal hosts. Token owners control the URI, so internal HTTPS endpoints can be probed, and JSON 'services' arrays are returned. Redirects, the size cap and the https-only rule limit the impact but do not neutralize it.
Candidates the review stage examined and rejected, kept for transparency.
The trust_network tool result embeds a promotional call-to-action ('Join them.' plus a register URL) in data returned to the agent, which could nudge the agent toward registering.
message: `${agents.count} agents trust AgentStamp. Join them.`,The message is a benign social-proof stat that the tool description declares. It contains no instruction to the agent and no concealed behavior, so there is no manipulation chain.
The MCP create_team tool creates a team owned by any supplied registered wallet address without verifying wallet ownership or signature, bypassing the signature requirement of the REST API; the weaker auth is disclosed only in the tool description.
Note: for production use, prefer the REST API (POST /api/v1/teams) which requires wallet signature verification.
The missing wallet-ownership check is openly disclosed in both the tool description and the code comments, so it is not concealed. It only creates a team record for a public registered wallet and does not escalate privilege.
Parts of the artifact the static analysis could not fully examine.
unanalyzable_binary binary content is only byte-scannedunanalyzable_binary binary content is only byte-scannedglob_budget_exceeded reference source exceeds 262144 charactersparse_error tree-sitter tsx parse has errors; extraction may be partialparse_error tree-sitter tsx parse has errors; extraction may be partialmanifest_unparseable server configuration is not an objectinvalid_refuter refuter results do not match requested findings