Skills agentic-wallet Audit History
📦

Audit History

agentic-wallet - 2 audits

Version comparison

Capability and finding changes across audited versions, newest first.

VersionDateResultReview itemsChange vs previous
v2 LatestJul 21, 2026, 02:27 AM 2 confirmed0No capability change
v1 Jul 9, 2026, 11:33 PM 3 confirmed22Baseline

Jul 21, 2026, 02:27 AM

All 78 static matches are false positives: they identify documentation text, explicit service URLs, or variable names rather than hidden execution, reconnaissance, or secret handling. However, the skill enables irreversible transfers, swaps, and automatic x402 payments without requiring final confirmation or a mandatory payment limit.

10
Files scanned
1,415
Lines analyzed
5
Review items
0
False positives ignored

Confirmed security concerns (2)

High
Irreversible Financial Actions Lack Confirmation Gate
The skill documents token transfers, swaps, and automatic paid API calls, but it does not require an explicit user confirmation after the final recipient, amount, asset, network, or payment limit is shown.
The cited instructions enable transfers, trades, and automatic USDC payments but specify no final confirmation step. These actions can create irreversible financial loss if model interpretation or user input is wrong.
High
Paid Requests May Proceed Without a Required Spending Limit
The x402 payment command supports a maximum amount, but the documented default examples omit it. A paid endpoint can therefore charge an amount not explicitly bounded by the user.
The command syntax makes the maximum payment optional, and two auto-pay examples omit it. The absence of a mandatory limit creates a clear risk of unintended spending.
Audited by: claude

Jul 9, 2026, 11:33 PM

The reviewed files describe a legitimate Coinbase awal wallet skill, not malware or prompt injection. The main risks are intentional: external CLI execution, real crypto transfers and swaps, automatic x402 payments, and sensitive wallet authentication and API secret handling.

10
Files scanned
1,415
Lines analyzed
28
Review items
0
False positives ignored

Confirmed security concerns (3)

High
Autonomous Crypto Transfer And Trade Capability
The skill routes agents to send tokens and trade assets through awal. These workflows can move user funds and may be irreversible.
SKILL.md lists send and trade commands, and the referenced files describe token transfer and swap workflows. The financial action is explicit and user funds are at stake.
High
Automatic Paid x402 API Calls
The skill can call x402 endpoints with automatic USDC payment and paid CDP SQL queries. This can spend funds on external services.
The files explicitly describe x402 pay commands and a charged CDP SQL endpoint. The behavior is legitimate, but it creates direct spend and external request risk.
High
Sensitive Wallet Authentication Commands
The skill includes CLI commands for wallet login and OTP verification. These steps can grant wallet access and should remain human-mediated.
The command index lists auth login with email and auth verify with OTP. The evidence is concise, but authentication to a spending wallet is clearly sensitive.
Capability review items (22)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Generic API/secret keys
This requires `CDP_API_KEY_ID` and `CDP_API_KEY_SECRET` environment variables. Get these from https:
The production facilitator instructions require CDP_API_KEY_ID and CDP_API_KEY_SECRET environment variables. This is legitimate configuration, but it introduces sensitive credential handling risk.
High
Ruby/shell backtick execution
| `npx awal@2.12.0 send <amount> <recipient>` | Send tokens |
The command index instructs running npx awal send with an amount and recipient. This can transfer real crypto assets and should require explicit confirmation.
High
Ruby/shell backtick execution
| `npx awal@2.12.0 trade <amount> <from> <to>` | Swap tokens |
The command index instructs running npx awal trade with token amounts. This can swap real assets and may incur irreversible financial loss.
Medium
Ruby/shell backtick execution
Operate a crypto wallet through the `awal` CLI. This skill is a router: read the relevant reference
The skill explicitly operates a crypto wallet through the awal CLI. That external command surface can authenticate, inspect balances, and move funds.
Medium
Ruby/shell backtick execution
| `npx awal@2.12.0 status` | Server health + auth status |
The command index instructs running npx awal status. This is an external CLI command, although it is read-only status checking.
Medium
Ruby/shell backtick execution
| `npx awal@2.12.0 address` | Get wallet address |
The command index instructs running npx awal address. This executes an external CLI and exposes wallet address information.
Medium
Ruby/shell backtick execution
| `npx awal@2.12.0 balance` | Get balances across Base, Polygon, Solana (use `--chain` for one chain
The command index instructs running npx awal balance. This executes an external CLI and reads wallet balances.
Medium
Ruby/shell backtick execution
| `npx awal@2.12.0 show` | Open the wallet companion window (used for funding) |
The command index instructs running npx awal show. This executes an external CLI and opens the wallet companion interface.
Medium
Ruby/shell backtick execution
| `npx awal@2.12.0 auth login <email>` | Send OTP code |
The command index instructs running npx awal auth login with a user email. This external command starts wallet authentication and handles sensitive identity input.
Medium
Ruby/shell backtick execution
| `npx awal@2.12.0 auth verify <otp>` | Complete sign-in |
The command index instructs running npx awal auth verify with an OTP. OTP submission is sensitive because it can complete wallet authentication.
Medium
Ruby/shell backtick execution
| `npx awal@2.12.0 x402 bazaar search <query>` | Search paid services |
The command index instructs running npx awal x402 bazaar search. This executes an external CLI that contacts a paid service marketplace.
Medium
Ruby/shell backtick execution
| `npx awal@2.12.0 x402 bazaar list` | List bazaar resources |
The command index instructs running npx awal x402 bazaar list. This executes an external CLI that retrieves marketplace resources.
Medium
Ruby/shell backtick execution
| `npx awal@2.12.0 x402 details <url>` | Inspect payment requirements |
The command index instructs running npx awal x402 details against a URL. This executes an external CLI and probes payment requirements for an endpoint.
Low
Hardcoded URL · 4 occurrences
npx awal@2.12.0 x402 pay https://x402.cdp.coinbase.com/platform/v2/data/query/run -X POST -d '{"sql"
This command sends a paid SQL request to Coinbase CDP through an x402 endpoint. It is intended functionality, but it is still an external network and payment surface.
Low
Hardcoded URL
const facilitator = new HTTPFacilitatorClient({ url: "https://x402.org/facilitator" });
The generated server code hardcodes the x402 facilitator URL. This is an expected dependency, but it routes payment verification through an external service.
Low
Hardcoded URL
const facilitator = new HTTPFacilitatorClient({ url: "https://x402.org" });
The API reference shows a hardcoded x402 facilitator endpoint. This is legitimate x402 setup, but it is an external network dependency.
Low
Hardcoded URL
npx awal@2.12.0 x402 pay https://example.com/api/weather
The example URL is a placeholder, but the documented command performs an x402 paid network request. The risk is spending funds on an external endpoint.
Low
Hardcoded URL
npx awal@2.12.0 x402 pay https://example.com/api/sentiment -X POST -d '{"text": "I love this product
The example URL is a placeholder, but the command pattern posts data to an external x402 endpoint with payment. This is expected but still a network and spend surface.
Low
Hardcoded URL
npx awal@2.12.0 x402 pay https://example.com/api/data --max-amount 100000
The example URL is a placeholder, but the command teaches paying an external endpoint with a maximum amount. This creates a bounded but real payment risk.
Audited by: codex