spider-strategy
Warn
Audited by Snyk on May 15, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill is explicitly an "Agentic portfolio operator" that makes trading decisions and executes position-level actions. It repeatedly references fills, fill budgets, pilot entry sizing (Day 1: 50% anchor, Day 2: 75% anchor / 25% basket, Day 3: 100% / 40%), fills_in_rolling_7d, fees_paid_per_leg, funding_harvested, forced exits, and portfolio-level exits. It targets crypto/alts (funding harvest, shorts on alt-coins) and describes go/no-go strike conditions and automatic abort/close behavior. Although some runtime components are "not yet built" (e.g., dsl_portfolio exit engine), the prompt states Spider enforces these in the LLM action layer and will make real trades after warmup. These are specific market-order/crypto trading capabilities (directly moving capital), not just generic scanning or logging, so this qualifies as Direct Financial Execution.
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata