stigg-api

Warn

Audited by Snyk on Jun 17, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). The Stigg skill is explicitly a billing/entitlements API: it documents REST/GraphQL endpoints and SDKs for customers, subscriptions, coupons, invoices, and monetary fields (including invoice previews and charge amounts). It describes write-capable API keys (server-/scoped keys) and scoped permissions like "Subscriptions write", "Customers write", and "Coupons write", plus authenticated POST examples (e.g., creating customers) and idempotent POST semantics. These are specific, non-generic financial operations (creating/updating subscriptions, managing invoices/coupons, handling money amounts), so the skill grants direct financial execution capability.

Issues (1)

W009
MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 17, 2026, 07:04 AM
Issues
1
Security Audit — snyk — stigg-api