fund
Warn
Audited by Snyk on Feb 21, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.80). The skill invokes remote executable code at runtime via "npx awal@latest" (which pulls and runs the npm package https://registry.npmjs.org/awal), so it depends on external code that is fetched-and-executed and could control agent behavior.
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill is explicitly designed to move money: it implements funding/onramp functionality to buy and deposit USDC using Coinbase Onramp/Coinbase Pay and lists payment methods (Apple Pay, debit card, bank transfer). It’s specifically targeted at crypto/fiat payment flows (buying USDC and depositing to a wallet address), which qualifies as direct financial execution capability.
Audit Metadata