arkiv-entity-expiration
Warn
Audited by Snyk on Oct 9, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (medium risk: 0.30). The skill describes entity lifetime extensions and interactions with the
@arkiv-network/sdk, including callingwallet.extendEntity(...)to update blockchain entities which may spend GLM tokens as gas/fees ("Run renewals only when the user authorized the target and GLM spend"). This constitutes a direct financial operation (transaction submission involving token/gas spend). However, looking at the access control aspect for direct operations, the operations are executed via a wallet client object (wallet.extendEntity) which requires an explicitly connected wallet and authorized signer credentials managed by the execution layer/SDK integration. Independent service authentication/wallet authorization gating the route is present through the standard viem wallet/signer architecture described.
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata