coinbase-cdp-connector

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly requires fetching and running remote code via npx @coinbase/cdp-cli@latest (the Coinbase CDP CLI package), which at runtime downloads and executes external code and serves as an MCP/agent skill that can control tool-calls and prompts.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly for Coinbase CDP and exposes CDP wallets, trading, payments, and on-chain operations via the cdp-cli. It describes creating accounts, routing orders to testnet or live, and a documented live path that, when enabled with the user's CDP API key and confirmations, will place real trades. These are specific crypto/financial execution capabilities (wallets, trading, onchain ops), not generic tooling.