dire-strategy

Warn

Audited by Snyk on May 15, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). The skill is explicitly a trading/execution skill for the XYZ (BRENTOIL) asset and contains concrete, specific mechanisms to move money and place/close market positions. Evidence:
  • Direct commands/tools named for execution: create_position, close_position, edit_position, cancel_order, ratchet_stop_add / ratchet_stop_edit / ratchet_stop_delete, strategy_close_positions / strategy_close. These are explicit trade/order APIs.
  • Execution mechanism: Python scanner invokes the mcporter CLI subprocess directly for create_position and ratchet_stop_add (Wolverine pattern). This is a specific execution path, not a generic "make HTTP request."
  • Financial parameters and behavior are defined: leverage (3x–10x), isolated margin, orderType (FEE_OPTIMIZED_LIMIT), fee/slippage handling, DSL tier ladder, starting budget and wallet in config, and state files tracking account_value and drawdown circuit breakers.
  • The skill specifies runtime and cron entry points that perform automated entries and exits (producer cron and DSL ratchet engine), and mandates that user-facing sessions must not call the listed trade APIs—confirming those APIs exist and are used by the system.

These are specific market-order and wallet-related capabilities (DEX trading, position creation/closure, margin/leverage settings), which meet the criteria for Direct Financial Execution.

Issues (1)

W009
MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

Audit Metadata
Risk Level
MEDIUM
Analyzed
May 15, 2026, 10:51 AM
Issues
1