sale-tracking

Warn

Audited by Snyk on May 9, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). The skill includes explicit payment-gateway integrations and examples: Option B shows direct Stripe API usage (stripe.checkout.sessions.create with line_items, mode='payment' and subscription metadata), and Option C includes a CLI flow that "auto-configures all Stripe webhooks via OAuth". Option A defines a Sale API endpoint that records transactions including amount_cents and transaction_id. These are specific, non-generic payment APIs and flows (Stripe and a sale-tracking API) rather than generic browser or HTTP tooling, so the skill grants direct financial execution/interaction capability.

Issues (1)

W009
MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

Audit Metadata
Risk Level
MEDIUM
Analyzed
May 9, 2026, 06:34 AM
Issues
1