create-paykit
Warn
Audited by Snyk on Apr 11, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill is explicitly designed to implement billing and integrates with Stripe as the payment provider. It requires STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET, configures a stripe provider (provider: stripe({...})), installs an @paykitjs/stripe package, and includes commands that "push" plans/prices to Stripe (npx paykitjs push). These are specific payment-gateway integrations/operations (creating/syncing plans/prices and mounting route handlers tied to Stripe) — not a generic API or browser automation. Therefore it grants direct financial execution capability.
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata