openfin-onramp

Warn

Audited by Snyk on May 12, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). The skill is explicitly a fiat→crypto onramp integrating two payment gateways (Moonpay and Onramp.money). It exposes endpoints (POST /agent/onramp, /onramp/moonpay, /onramp/onrampmoney) that accept fiat amounts, baseCurrency, paymentMethod, walletAddress, currency/currencyCode and return provider URLs to complete payment/KYC. These are specific payment-gateway APIs for initiating fiat purchases of crypto (including provider routing and amount/payment-method control). Even though the user completes the provider UI and the agent does not sign on-chain transactions, the skill's primary purpose is to initiate and route real-money onramp transactions. That meets the criteria for Direct Financial Execution.

Issues (1)

W009
MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

Audit Metadata
Risk Level
MEDIUM
Analyzed
May 12, 2026, 07:58 PM
Issues
1
Security Audit — snyk — openfin-onramp