deepbook-move

Warn

Audited by Snyk on Aug 21, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

  • Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent at runtime to query external documentation and source repositories (e.g., https://sui.mcp.kapa.ai and https://docs.sui.io/onchain-finance/deepbook/deepbookv3 and GitHub sources) to fetch docs/source files that will be used to verify and generate answers, meaning remote content directly controls the agent's responses.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). This skill is explicitly a DeepBook V3 Move smart-contract integration reference that documents and instructs how to place orders, execute swaps, borrow and repay flash loans, create pools, and manage balances/capabilities from on‑chain Move code. Those are specific blockchain financial operations (trades, swaps, loans, deposit/withdraw capabilities) rather than generic tooling, so it grants direct financial execution capability.

Issues (2)

W012
MEDIUM

Unverifiable external dependency detected (runtime URL that controls agent).

W009
MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 21, 2026, 06:33 PM
Issues
2
Security Audit — snyk — deepbook-move