pay-for-service

BENIGN with elevated operational risk. The skill’s capabilities match its stated purpose, and the install path is consistent with Coinbase-published npm/docs evidence rather than a random payload. Main concerns are the unpinned `@latest` CLI dependency, limited independent verifiability of the installed wallet/server component, and the fact that it enables real USDC payments to third-party endpoints.