sale-tracking
Warn
Audited by Snyk on May 9, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill includes explicit payment-gateway integrations and examples: Option B shows direct Stripe API usage (stripe.checkout.sessions.create with line_items, mode='payment' and subscription metadata), and Option C includes a CLI flow that "auto-configures all Stripe webhooks via OAuth". Option A defines a Sale API endpoint that records transactions including amount_cents and transaction_id. These are specific, non-generic payment APIs and flows (Stripe and a sale-tracking API) rather than generic browser or HTTP tooling, so the skill grants direct financial execution/interaction capability.
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata