dire-strategy
Warn
Audited by Snyk on May 15, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill is explicitly a trading/execution skill for the XYZ (BRENTOIL) asset and contains concrete, specific mechanisms to move money and place/close market positions. Evidence:
- Direct commands/tools named for execution: create_position, close_position, edit_position, cancel_order, ratchet_stop_add / ratchet_stop_edit / ratchet_stop_delete, strategy_close_positions / strategy_close. These are explicit trade/order APIs.
- Execution mechanism: Python scanner invokes the mcporter CLI subprocess directly for create_position and ratchet_stop_add (Wolverine pattern). This is a specific execution path, not a generic "make HTTP request."
- Financial parameters and behavior are defined: leverage (3x–10x), isolated margin, orderType (FEE_OPTIMIZED_LIMIT), fee/slippage handling, DSL tier ladder, starting budget and wallet in config, and state files tracking account_value and drawdown circuit breakers.
- The skill specifies runtime and cron entry points that perform automated entries and exits (producer cron and DSL ratchet engine), and mandates that user-facing sessions must not call the listed trade APIs—confirming those APIs exist and are used by the system.
These are specific market-order and wallet-related capabilities (DEX trading, position creation/closure, margin/leverage settings), which meet the criteria for Direct Financial Execution.
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata