canton-external-signing
Warn
Audited by Snyk on Jun 25, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). Yes. The skill is explicitly about preparing, signing, and submitting on-ledger transactions: it describes the prepare→sign→execute flow, signing the transaction hash with the party's private key (Ed25519/BIP-0039), and using concrete APIs/endpoints (JSON Ledger API POST /v2/interactive-submission/prepare and /execute, gRPC InteractiveSubmissionService prepareSubmission/executeSubmission) and a wallet SDK that "wraps this prepare/sign/submit flow." These are specific blockchain/ledger signing and submission capabilities (wallet signing + transaction submission), i.e., direct execution of ledger transactions rather than a generic tool. That meets the criteria for Direct Financial Execution.
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata