openfactura-facturar

Warn

Audited by Snyk on Nov 12, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (medium risk: 0.30). Decisive operation: the skill issues real Salvadoran electronic tax documents (DTE: factura 01, CCF 03, credit/debit notes 05/06, etc.) through dte_emitir. Each emission is signed, transmitted to the tax authority, and consumes a control number (SKILL.md:8-9, 33-34). This is creating real bills/invoices, which the rubric classes as indirect. The skill does not itself transfer, charge, refund, or settle money. Payment terms (cash, credit, pagos codes) are recorded as invoice fields, not executed. The description's "cobrarle a un cliente" does not change this, because the skill only documents invoice issuance. Because the operation is indirect, the direct-operation access-control test does not apply. Consultation and validation are read-only or pre-emission checks. The pre-emission confirmation rule (SKILL.md:14-16) is an agent-followed instruction and is not treated as a qualifying control. The operation is financial and irreversible in effect, so it is rated Medium rather than No.

Issues (1)

W009
MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

Audit Metadata
Risk Level
MEDIUM
Analyzed
Nov 12, 2026, 03:40 PM
Issues
1