ore-miner
Warn
Audited by Snyk on Jun 19, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill is explicitly built to control on-chain funds and trading actions via refinORE's API. It includes endpoints to start/stop mining sessions that deploy SOL (POST /mining/start), execute direct token swaps (POST /swaps/execute), create/manage DCA and limit orders (POST /auto-swap-orders, PUT/DELETE /auto-swap-orders/:id), and live-edit session deployment amounts (PATCH /mining/session/edit and PATCH /auto-strategies/:id/live). The doc even states an explicit authorization model ("When the human gives an explicit imperative like 'Swap 2 stORE to SOL', that is enough authorization to execute"). These are concrete crypto/financial execution capabilities (wallet balances, swaps, order creation/execution, and deploying funds), not generic tools, so this grants direct financial execution authority.
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata