programmable-secrets
Warn
Audited by Snyk on Jun 17, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill explicitly exposes blockchain/marketplace transaction capabilities: it requires wallet-backed identities and private keys (ETH_PK, ETH_PK_2), targets chains (Arbitrum, Robinhood testnet), and provides commands that set prices in ETH and execute purchases (e.g., policies create-timebound --price-eth, purchase --policy-id, preview purchase, receipts get). It also supports registering identities on ERC-8004 and performing provider/agent writes. These are explicit crypto/blockchain payment and transaction operations (signing/sending on-chain purchases), so it grants Direct Financial Execution Authority.
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata