scenario-multi-reference
Warn
Audited by Snyk on Oct 17, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (medium risk: 0.30). The skill instructs the agent to run paid image generation models (
model_run) after obtaining a price quote usingdry_run=trueand ensuring budget constraints are met (run nothing paid until they agree (unattended, launch only inside a budget the task states)). This constitutes a direct financial operation (service usage charges / execution). However, access control is established via the Scenario MCP server tool authentication (model_run,recommend,upload_asset, etc.) which requires valid API credentials and service-side execution validation. Therefore, it qualifies for the medium tier due to independent access control.
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata