coinbase-agentkit

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). At runtime, the required workflow in the LangChain example template reads outsider-authored console/chat text via readline/HumanMessage(input) and passes it into the LangGraph React agent (agent.invoke) along with tool access (wallet/CDP actions), enabling indirect prompt injection through user-supplied free text.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed for on-chain financial operations. It includes wallet providers (CDP-managed wallets, private-key wallets), requires CDP API keys, and exposes action providers that perform financial transactions: native transfers, ERC-20 transfers/approvals, swaps/trades, lending/borrowing (Compound/Morpho), bridges, NFT minting, and other actions that sign and send transactions. Example: walletActionProvider exposes nativeTransfer; erc20ActionProvider exposes transfer; cdpApiActionProvider exposes tradeTokens/requestFaucet; the quickstart example shows conditional logic to send ETH. These are specific APIs to move funds and execute financial transactions, not generic tooling.