coinbase-cdp-connector

Pass

Audited by Gen Agent Trust Hub on Aug 20, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill documents the installation and use of the @coinbase/cdp-cli package via npx. This is an official tool provided by Coinbase, a well-known service, and is used for its intended purpose of managing blockchain operations and wallets.
  • [COMMAND_EXECUTION]: Provides instructions for running CLI commands such as cdp evm faucet and cdp evm accounts. These are standard operational commands for the Coinbase CDP toolset and are gated behind user-provided credentials and explicit confirmation steps.
  • [DATA_EXPOSURE]: Describes the management of sensitive CDP API keys using environment variables (CDP_API_KEY_JSON) and local JSON files. The skill instructs users to handle these credentials out-of-band and provides a path for secure local referencing rather than hardcoding secrets.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes an architecture where it processes order data produced by other components (e.g., crypto-daytrading).
  • Ingestion points: An Order list processed by notify_executor.py.
  • Boundary markers: None explicitly defined in the documentation.
  • Capability inventory: Execution of on-chain trades and wallet operations via the CDP CLI.
  • Sanitization: Employs deterministic safety checks in hard_caps.py (notional caps, daily-loss kill switches, and an immutable audit log) that operate outside the influence of the LLM to prevent unauthorized or excessive trade execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 20, 2026, 02:21 PM
Security Audit — agent-trust-hub — coinbase-cdp-connector