send-usdc

BENIGN for stated purpose, but high-impact by nature. The skill's capabilities align with sending USDC, and the CLI provenance appears same-org/official via Coinbase npm/GitHub references. Main risks are financial autonomy and executing an unpinned external CLI (`npx awal@latest`) that can move funds; this is a security-risky skill even without signs of malware or credential theft.