wechat-pay-apis

Warn

Audited by Snyk on Jun 20, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). This skill is explicitly a payment integration for WeChat Pay v3. It defines payment endpoints (POST /v3/pay/transactions/... for JSAPI/APP/NATIVE/H5), order lifecycle operations (create/unified order, query orders, close orders), and refund APIs (POST /v3/refund/domestic/refunds). It includes SDK initialization with merchant credentials (mchid, merchant private key, apiV3Key) and code samples that perform actual payment operations (creating prepay_id/code_url/h5_url) and issuing refunds/closing orders. These are specific payment gateway functions that can move money or initiate refunds — therefore it grants direct financial execution authority.

Issues (1)

W009
MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 20, 2026, 02:29 PM
Issues
1