trails
Warn
Audited by Snyk on Feb 16, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill is explicitly designed for crypto financial operations. It documents Trails functionality for cross-chain token transfers, swaps, and smart-contract execution, and provides concrete, named APIs and code paths that perform money-moving actions:
- Widget modes: "Pay, Swap, Fund, Earn" (drop-in UI for payments and swaps).
- Headless SDK: exposes hooks such as useTrailsSendTransaction with a sendTransaction call.
- Direct API / Server example: uses @0xtrails/trails-api with TrailsAPI and explicit methods quoteIntent, commitIntent, executeIntent, waitIntentReceipt to quote, lock, execute, and wait on token transfer/settlement flows.
- Fund mode calldata and encoding examples show constructing destination calldata for on-chain executions.
These are specific, purpose-built payment/crypto APIs (not generic HTTP or browser automation) that directly enable creating and executing financial transactions on-chain. Therefore it grants Direct Financial Execution Authority.
Audit Metadata