cloud-engine-canisters

Warn

Audited by Snyk on Aug 27, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). The skill explicitly documents a console proxy canister interface that accepts a "cycles" amount and re-issues calls with those cycles attached, including examples of forwarding calls to the XRC (exchange-rate canister) and to threshold signing APIs. It names management-canister signing methods (sign_with_ecdsa, sign_with_schnorr, vetkd_derive_key) and explains fetching/signing through the proxy. Those are specific blockchain/crypto signing and exchange interactions (i.e., explicit crypto/blockchain execution capability), so this skill grants direct financial execution authority per the policy.

Issues (1)

W009
MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 27, 2026, 04:51 AM
Issues
1
Security Audit — snyk — cloud-engine-canisters