telnyx-mpp-payment

Warn

Audited by Snyk on Aug 12, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

  • Potentially malicious external URL detected (high risk: 0.90). The skill invokes npx to fetch and execute remote packages at runtime (e.g., "npx --yes @stripe/link-cli@0.11.0" and "npx mppx"), so it relies on remotely fetched code that will be executed during the payment flow.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). The skill is explicitly designed to move real money. It documents the Telnyx MPP account-credit endpoint and provides concrete, step-by-step commands that perform payments: Stripe Link CLI commands to create/approve spend requests and execute a payment, and Tempo/mppx commands to sign and submit USDC payments from a wallet. These are payment gateways/crypto-wallet operations that grant direct financial execution capability.

Issues (2)

W012
MEDIUM

Unverifiable external dependency detected (runtime URL that controls agent).

W009
MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 12, 2026, 06:26 PM
Issues
2
Security Audit — snyk — telnyx-mpp-payment