checkout
Warn
Audited by Snyk on May 10, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). Yes. The skill is explicitly and primarily about billing flows and executing billing. It defines endpoints and handlers that re-run attach and "execute the real billing plan" on confirm (POST /:checkout_id/confirm), returns invoice_id, controls whether to redirect to Stripe checkout vs run Autumn billing, and calls functions like executeBillingPlan/createAutumnCheckout/handleConfirmCheckout. These are specific financial operations (creating checkout/payment URLs, executing charges/billing plans, integrating with Stripe checkout). This is not a generic tool — its purpose is to move money (execute billing).
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata