Coinbase Agent

Autonomous Coinbase integration for portfolio tracking, trading, and on-chain payments. USE WHEN: the user wants to check Coinbase balances, execute trades,...

Security Scan

The skill's instructions claim to use Coinbase API keys and the Coinbase Developer Platform SDK, but the registry metadata doesn't declare any required credentials, install steps, or provenance — the missing pieces create incoherence and a real risk if you provide live API keys.

Purpose & Capability

The skill's name/description state it will authenticate to Coinbase and execute trades/transfers via the Coinbase Developer Platform (CDP). Yet the registry metadata lists no required credentials, no primary credential, and no required binaries. A trading/transfer agent legitimately needs API keys and an SDK or HTTP client; those are not declared here, which is inconsistent.

Instruction Scope

SKILL.md explicitly says authentication uses CDP API keys stored in a .env file and that the agent will 'call the CDP SDK' and perform swaps/transfers. The instructions therefore expect access to secret API keys and to a runtime library — but they do not specify how keys are supplied, how the .env is accessed, or what confirmation flow actually enforces trade limits. The agent could be instructed (or assume it may) to read .env or other local files to get credentials, which is outside the declared scope.

Install Mechanism

This is instruction-only (no install spec, no code). That is low-risk in itself, but also means the skill assumes the runtime has the CDP SDK and any other tooling available; there's no provenance or official package referenced. Expect runtime failures or undefined behavior unless the environment already contains the required SDK, which is not documented.

Credentials

SKILL.md requires CDP API keys (secrets), but requires.env and primary credential fields are empty. Requesting unlimited access to trading and transfers without declaring which environment variables or scopes are needed is disproportionate and hides the exact secrets the skill will access. The instruction to store keys in .env suggests the agent will read local secrets not declared to the registry.

Persistence & Privilege

The skill is not set to always:true and uses normal autonomous invocation settings. Autonomous operation combined with undisclosed API key usage increases blast radius if keys are provided. However, there is no evidence the skill tries to modify other skills or system configuration.

What to consider before installing

Do not install or provide live Coinbase API keys to this skill until these questions are answered and the missing pieces are fixed: 1) Which exact environment variables (names) does the skill require (API key, secret, passphrase, scopes)? 2) Provide an explicit install spec or a referenced official SDK/package (e.g., official Coinbase SDK from a known registry) so reviewers can inspect what will run. 3) Show the code or an auditable implementation of the 'manual confirmation' guardrail and how it prevents unauthorized trades. 4) Prefer providing read-only credentials for initial testing (balance-only scopes) and use a segregated Coinbase account with minimal funds; do not give keys with withdrawal/send scopes until you trust the skill. 5) If you must test transfers, create API keys with the least privileges and disable withdraws where possible; verify Coinbase's API scope model and use keys that explicitly block transfers. 6) Because provenance is unknown (no source/homepage), treat this as higher risk — prefer skills with公開 source or from known publishers. If you proceed, require transparency (explicit env var names and code or install spec) and test first with read-only credentials and small amounts.

Coinbase Agent (CDP)

Version: 1.0.0 Price: $29 Type: Skill

Description

Unlock autonomous crypto operations. Powered by the Coinbase Developer Platform (CDP) and AgentKit, this skill allows Clawdia to manage your Coinbase portfolio directly. From simple balance checks to complex algorithmic trades and cross-chain transfers, this is the "Financial Brain" of your AI empire.

Commands

• "What is my Coinbase balance?"
• "Buy $10 of [asset] on Coinbase"
• "Send [amount] USDC from Coinbase to my Polygon wallet"

Workflow

1. Authentication: Uses CDP API Keys (stored securely in .env).
2. Real-time Monitoring: Pulls live price data and portfolio valuations.
3. Execution: Calls the CDP SDK to execute swaps or transfers based on user logic.

Guardrails

• Requires manual confirmation for any trade over a set limit (default: $100).
• Never shares raw API secret keys.
• Operates within Coinbase's security and rate limits.