dsl-engineering
Warn
Audited by Snyk on Apr 11, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill is explicitly a trading DSL (FinScript) with built-in, first-class constructs for placing and managing trades. Evidence:
- Lexer/keywords include Buy/Sell tokens.
- AST/Statements define StrategyEntry, StrategyExit, StrategyClose and Buy/Sell statements.
- Parser dispatches Token::Buy, Token::Sell and Token::Strategy to parse buy/sell/strategy commands.
- Examples and docs show strategy.entry("id","long", qty=...), strategy.exit(...), strategy.close(...).
- Interpreter maintains trading state (strategy_position, strategy_equity, strategy_entry_price) and describes how trades update PnL and equity.
- buy/sell produce Signal records and strategy.entry is described as opening positions (with qty/price/stop/limit).
These are not generic utilities; they are specific APIs for placing and managing market positions (i.e., moving capital/executing trades). Therefore this skill grants Direct Financial Execution Authority.
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata