base

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt includes examples that place private keys and API keys directly on the command line or in URLs (e.g., --private-key $PRIVATE_KEY, --etherscan-api-key $BASESCAN_API_KEY, RPC URLs with $CDP_API_KEY), which forces or encourages embedding secret values verbatim in commands/requests and creates an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In templates/base-app.ts, the runtime workflow sends a user-supplied JSON payload (userOp fields derived from free-form user interaction parameters) to Coinbase Developer Platform via fetch(paymasterUrl) and then processes the returned JSON; this can include outsider-authored error/message strings that become directly readable text to the code path.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documentation contains explicit blockchain payment and transaction APIs and examples that perform monetary actions: creating wallet clients with private keys, sending signed transactions (walletClient.sendTransaction / writeContract), token swaps, approvals/deposits, bridging (L1<->L2 deposits/withdrawals), and paymaster-sponsored transactions. These are specific, finance-moving capabilities (signing/sending value and invoking finance-related contract methods), not generic tooling — therefore it grants Direct Financial Execution authority.