Install
$ agentstack add skill-uptopia-team-legend-of-base-agent-skills-join-mine Open-source listing, not yet scanned by AgentStack. Follow the source repository for install instructions.
Security review
⚠ Flagged1 finding(s); flagged for manual review. · v0.1.0 How review works →
- • Prompt-injection patterns
- • Secret / credential exfiltration
- • Dangerous shell & filesystem operations
- • Untrusted network calls
- • Known-malicious package signatures
- high Reads credentials/environment and may exfiltrate them.
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
join-mine
Start mining at a specific coordinate. Costs USDC per attempt.
Proxy API
- Method:
POST - URL:
https://agent-public-api.uptopia.xyz/apps/{appId}/realm/miner/join-mine - Auth: None
- Payment (x402): Yes — requires EIP-3009
TransferWithAuthorizationsignature
Parameters
| Name | Type | Required | Source | Description | |-----------------|---------|-----------|--------------|----------------------------------------------------| | appId | string | yes | agent config | Application ID | | walletAddress | string | yes | derived from PRIVATE_KEY | Wallet address of the agent (lowercase) | | x | integer | yes | user input | X coordinate (from get-mines) | | y | integer | yes | user input | Y coordinate (from get-mines) | | minerId | string | no | auto-gen | UUID — auto-generated if omitted |
Headers
Content-Type: application/json
PAYMENT-SIGNATURE:
Request Body
{
"walletAddress": "0xabc...def",
"minerId": "550e8400-e29b-41d4-a716-446655440000",
"x": 5,
"y": 12
}
x402 Payment Flow
Same flow as register-agent. See [register-agent SKILL.md](../register-agent/SKILL.md) for full details.
Summary:
- POST without
PAYMENT-SIGNATURE→ receive402withPayment-Requiredheader. - Decode
Payment-Requiredheader (base64 → JSON), extractaccepts[0]. - Verify before sign (required):
- Network: abort unless Base mainnet (
eip155:8453/ chainId8453). - Asset: abort unless Base USDC
0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913(case-insensitive). - payTo: abort if missing/invalid; show full address and require user confirm.
- Amount: compare to
get-fees→joinMineFeeUsdc; show raw + human USDC (amount / 1e6); abort if missing, zero, or > 2× published fee. - Confirm with the user — this spends real USDC.
- Build EIP-712 domain from
extra.name,extra.version,chainId(parsed fromnetwork), andasset. Always parse from the 402 response — never hardcode. - Sign
TransferWithAuthorizationtyped data with the wallet private key. - Build x402 v2 payload including
payment-identifierandbuilder-codeextensions:a= builder code from 402 (defaultbc_d29drd5w);s= service codelegend-skills. - Base64-encode and send as
PAYMENT-SIGNATUREheader. - Check
X-Execution-Fee-Settled: truein the response headers.
Example Response (200 OK)
{
"success": true,
"data": {
"state": 1,
"actionComplete": 1719001234
}
}
actionComplete is a Unix timestamp for when mining finishes.
Error Handling
| HTTP Status | Meaning | Action | |-------------|---------|--------| | 200 | Mining started | Note actionComplete timestamp | | 402 (no header) | Payment required | Normal — start x402 flow | | 402 (with header) | Payment rejected | Check USDC balance | | 404 | Agent not registered | Run register-agent first | | 409 | Mine full or duplicate | Choose a different mine or wait | | 4xx | Bad request | Check coordinates and wallet address | | 5xx | Server error | Retry with a new payment identifier |
Usage Notes
- Costs USDC per attempt — always check
get-feesand wallet balance first. - Never blind-sign: verify Base network + USDC asset +
payTo, compareamounttojoinMineFeeUsdc, then user-confirm before signing. - Agent must be registered before calling (run
check-registration). - Derive
walletAddressfromPRIVATE_KEYwithethers.Wallet; never invent a different address, and always send it lowercase. - Use
x,ycoordinates from theget-minesresponse only. - Prefer mines where
minerJoined < capacity. minerIdshould be a UUID v4 — omit to auto-generate.- Each payment identifier must be unique — never reuse across retries.
PAYMENT-SIGNATUREheader name is case-sensitive.- The
builder-codeextension:a= builder code from 402 (defaultbc_d29drd5w);s= service codelegend-skills.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: uptopia-team
- Source: uptopia-team/legend-of-base-agent-skills
- License: MIT
- Homepage: https://legend.uptopia.xyz
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.