The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references official documentation and example code hosted on docs.cdp.coinbase.com and github.com/coinbase/cdp-sdk. These are well-known, trusted resources associated with the skill's author.
[COMMAND_EXECUTION]: The skill provides standard package installation commands for Node.js (npm install) and Python (pip install). The packages listed (e.g., @coinbase/cdp-sdk, cdp-sdk, x402) are official libraries for the Coinbase Developer Platform.
[CREDENTIALS_UNSAFE]: The skill explicitly advises against hardcoding secrets, instructing the user to confirm that CDP_API_KEY_ID, CDP_API_KEY_SECRET, and CDP_WALLET_SECRET are stored in environment variables. It also includes a safety check requiring the agent to echo back a payTo address for confirmation before writing it to code.
[PROMPT_INJECTION]: The skill includes internal safety guidelines for the agent, such as preventing mainnet deployment without explicit user consent in the current turn. There are no patterns suggesting attempts to bypass safety filters or override system instructions.
[INDIRECT_PROMPT_INJECTION]: The skill describes building a web server that processes external HTTP requests using the x402 protocol. While this creates a network-facing attack surface, the provided code templates use standard middleware from the CDP SDK, and the severity is assessed as safe within the context of the skill's primary purpose.

build-x402-server