Versioned security assessment

Report ID: SA-3F6E026A

7/21/2026, 2:27:09 AM

agentic-wallet security assessment v2

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: claude Latest published report
Skill name
agentic-wallet
Version
v2
Maintainer
internet-court
Source
github.com/internet-court/internet-court-skill/tree/main/vendored/coinbase/agentic-wallet
Coverage
10 Files scanned · 1,415 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

High

2 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

All 78 static matches are false positives: they identify documentation text, explicit service URLs, or variable names rather than hidden execution, reconnaissance, or secret handling. However, the skill enables irreversible transfers, swaps, and automatic x402 payments without requiring final confirmation or a mandatory payment limit.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Attestation unavailable

No public attestation is available for this report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

10 Files scanned · 1,415 Lines analyzed

2 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 13 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Observed in 1 evidence location

External commands

May invoke commands or programs outside the Skill.

Observed in 30 evidence locations

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 High
SKILL.md:59-64references/send-usdc.md:3-10references/x402-pay.md:3-10
Irreversible Financial Actions Lack Confirmation Gate
The skill documents token transfers, swaps, and automatic paid API calls, but it does not require an explicit user confirmation after the final recipient, amount, asset, network, or payment limit is shown.
The cited instructions enable transfers, trades, and automatic USDC payments but specify no final confirmation step. These actions can create irreversible financial loss if model interpretation or user input is wrong.
RISK-002 High
references/x402-pay.md:10-23references/x402-pay.md:50-58
Paid Requests May Proceed Without a Required Spending Limit
The x402 payment command supports a maximum amount, but the documented default examples omit it. A paid endpoint can therefore charge an amount not explicitly bounded by the user.
The command syntax makes the maximum payment optional, and two auto-pay examples omit it. The absence of a mandatory limit creates a clear risk of unintended spending.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Transfers, trades, and paid requests can execute without a final user approval step.
    Require explicit confirmation after displaying the exact recipient or URL, asset, amount, network, fees, and total cost. Do not execute when any value changes after confirmation.
  2. FIX-002
    High
    x402 payments can be made without a defined maximum amount.
    Require --max-amount for every x402 pay command and reject payment when the endpoint price exceeds the user-approved limit.
  3. FIX-003
    Medium
    The skill permits commands that move funds or deploy paid services.
    Separate read-only discovery from state-changing commands and document a confirmation policy for every state-changing workflow.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
3f6e026a3363e0954ede7bef0cfe88d4475de137
Content hash
1c472f4e1a25bbe547fd1ffaf74c0b25cd422ea7360905b18cd42910f46962ec
Tree hash
864803d1dd2f9e8a23f5cd4555272d0b419866074a8d12b6179887422b17fc27
Skill path
skills/internet-court/agentic-wallet
Audit payload hash
da5772c0768119e1e63f1d7af1a73b15

Analysis metadata

Audit model: claude

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: unavailable