moneydevkit-nextjs

Warn

Audited by Snyk on Apr 25, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). This skill is explicitly designed to perform real payment operations. It integrates MoneyDevKit (MDK) to embed Lightning Bitcoin payments and exposes specific handlers/APIs that create and confirm monetary transactions:
  • Provides create_checkout, confirm_checkout, get_checkout, createCheckoutUrl and related handlers that generate Lightning invoices, set amounts (USD cents or satoshis), and confirm payments.
  • Supports PRODUCTS with CUSTOM pricing and a two-step flow (create then confirm) that sets user-chosen amounts — i.e., it programmatically initiates and finalizes payment requests.
  • Exposes a server-side callMdk wrapper that calls the MDK server route directly using MDK_ACCESS_TOKEN (and mentions MDK_MNEMONIC), with an x-moneydevkit-webhook-secret header that bypasses CSRF — enabling server-side authenticated payment operations.
  • Outputs Lightning invoice strings (for QR codes) and polls for payment status, enabling detection and processing of completed payments.

These are specific payment/crypto APIs (Lightning/Bitcoin wallet and checkout operations), not generic tooling. Therefore it grants direct financial execution capability.

Issues (1)

W009
MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 25, 2026, 10:54 PM
Issues
1