x402
Search for new services and make paid API requests using the x402 payment protocol. Use when you don't have a clear tool to choose, search the bazaar. You can also use this tool if you or the user want to call an x402 endpoint, discover payment requirements, browse the bazaar, or search for paid services.
62
73%
Does it follow best practices?
Impact
—
No eval scenarios have been run
Advisory
Suggest reviewing before use
Optimize this skill with Tessl
npx tessl skill review --optimize ./skills/x402/SKILL.mdSecurity
2 findings — 2 medium severity. This skill can be installed but you should review these findings before use.
W011: Third-party content exposure detected (indirect prompt injection risk)
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
Third-party content exposure detected (high risk: 1.00). The SKILL.md explicitly instructs the agent to search and browse the public "bazaar" and to call arbitrary URLs (e.g., `npx awal x402 bazaar search/list` and `npx awal x402 details <url>` / `x402 pay <url>`), which fetches and interprets untrusted third-party endpoints and their schemas/prices and can drive payment/call behavior.
W009: Direct money access capability detected (payment gateways, crypto, banking)
What this means
The skill is specifically designed for direct financial operations, giving the agent the ability to move money or execute financial transactions — such as payment processing, cryptocurrency operations, banking integrations, or market order execution.
Why it was flagged
Direct money access detected (high risk: 1.00). The skill explicitly implements a payment protocol that sends USDC on a blockchain ("Payments are made in USDC on Base") and provides commands to discover paid endpoints and "Make a Paid Request" (npx ... x402 pay ...) with automatic USDC payment. It includes authentication steps, balance checking, max-amount limits, and filters like --pay-to and --asset. These are specific crypto/payment operations (wallet/payments) rather than generic HTTP or browsing tools, so it grants direct financial execution capability.
- Repository
- coinbase/agentic-wallet-skills
- Commit
5cb01b5
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.