skills/starchild-ai-agent/official-skills/treasures/Snyk

treasures

Warn

Audited by Snyk on Sep 17, 2026

Risk Level: MEDIUM

Full Analysis

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

Potentially malicious external URL detected (medium risk: 0.30). The skill instructs installation from an external GitHub repository (treasures-io/treasures-finance-agent-skills) via npx skills add, which constitutes an unverifiable runtime external dependency from an unofficial third-party source.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

Direct money access detected (high risk: 1.00). The skill documentation explicitly details financial operations, specifically tokenized stocks (xStocks/Ondo) trading, USDC bridging, and executing trades (/quote/buy, /quote/sell, /trade/submit, /bridge/quote) via specific APIs. This explicitly falls under direct financial execution authority (market orders/crypto/asset trading).

Issues (2)

W012

MEDIUM

Unverifiable external dependency detected (runtime URL that controls agent).

W009

MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

Audit Metadata

Risk Level

MEDIUM

Analyzed

Sep 17, 2026, 04:27 AM

Issues

2

Security Audit — snyk — treasures