yellow-best-practices
Warn
Audited by Snyk on Feb 16, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill is explicitly for Yellow Network / Nitrolite state-channel financial operations: it includes wallet signing code (ethers.Wallet, signing digests), APIs/functions like createAppSessionMessage and createGetLedgerBalancesMessage, ClearNode integration for off-chain transactions, and allocation objects that set asset amounts. These are specific crypto/blockchain payment and transaction primitives (signing and managing on/off‑chain balances), not generic tooling—so it grants direct financial execution capability.
Audit Metadata