moneydevkit-nextjs
Warn
Audited by Snyk on Apr 25, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). This skill is explicitly designed to perform real payment operations. It integrates MoneyDevKit (MDK) to embed Lightning Bitcoin payments and exposes specific handlers/APIs that create and confirm monetary transactions:
- Provides create_checkout, confirm_checkout, get_checkout, createCheckoutUrl and related handlers that generate Lightning invoices, set amounts (USD cents or satoshis), and confirm payments.
- Supports PRODUCTS with CUSTOM pricing and a two-step flow (create then confirm) that sets user-chosen amounts — i.e., it programmatically initiates and finalizes payment requests.
- Exposes a server-side callMdk wrapper that calls the MDK server route directly using MDK_ACCESS_TOKEN (and mentions MDK_MNEMONIC), with an x-moneydevkit-webhook-secret header that bypasses CSRF — enabling server-side authenticated payment operations.
- Outputs Lightning invoice strings (for QR codes) and polls for payment status, enabling detection and processing of completed payments.
These are specific payment/crypto APIs (Lightning/Bitcoin wallet and checkout operations), not generic tooling. Therefore it grants direct financial execution capability.
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata