wechat-pay-apis
Warn
Audited by Snyk on Jun 20, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). This skill is explicitly a payment integration for WeChat Pay v3. It defines payment endpoints (POST /v3/pay/transactions/... for JSAPI/APP/NATIVE/H5), order lifecycle operations (create/unified order, query orders, close orders), and refund APIs (POST /v3/refund/domestic/refunds). It includes SDK initialization with merchant credentials (mchid, merchant private key, apiV3Key) and code samples that perform actual payment operations (creating prepay_id/code_url/h5_url) and issuing refunds/closing orders. These are specific payment gateway functions that can move money or initiate refunds — therefore it grants direct financial execution authority.
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata