Security audit

CDP Wallet

Security checks across malware telemetry and agentic risk

Overview

This is an openly documented crypto wallet skill, but it lets an agent move funds and make paid web requests without built-in spending, recipient, domain, or network limits.

Install only if you intentionally want an agent to spend from a Coinbase CDP wallet. Use a dedicated low-balance wallet, test with base-sepolia first, isolate the CDP credentials, restrict approved recipients and x402 domains outside the skill, and require explicit approval or CDP policy limits before allowing autonomous payments.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The documentation frames the skill as 'Base only,' but later states that `pay-x402` will honor whatever network a remote server demands. That creates a dangerous trust boundary failure: an agent or operator may believe payments are constrained to Base while a malicious or unexpected x402 server can steer signing/payment behavior onto another chain.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The pay-x402 command accepts any http/https URL and arbitrary headers/body, then performs a network request with a wallet-backed x402 payment client. In an agent setting this is an SSRF-capable primitive plus an uncontrolled payment primitive: a prompt or tool caller can direct the skill to contact attacker-chosen endpoints, potentially spend funds, and interact with internal or sensitive services reachable from the runtime.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The file-level description explicitly states that pay-x402 supports any EVM network requested by the remote server rather than constraining settlement to Base. That breaks the skill's stated Base-focused trust boundary and allows a remote endpoint to steer signing/payment flow onto another chain, increasing the chance of unexpected asset use, policy bypass, or signing behavior outside the operator's assumptions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: `pay-x402` is documented as a transparent one-call flow even though it can both transmit arbitrary request data to external servers and authorize blockchain payments. Without an explicit warning or confirmation boundary, an agent may invoke it as if it were a normal HTTP fetch, causing unintended fund expenditure and sensitive data disclosure to untrusted endpoints.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: `send-usdc` performs irreversible value transfer, but the usage documentation lacks a direct warning about recipient verification and finality. In an agent setting, this omission increases the risk of misdirected or prompt-induced transfers because operators may not realize the command should be guarded like a payment primitive rather than a routine API call.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.