sbtc-auto-funnel

Warn

Audited by Snyk on Apr 16, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). The skill is explicitly designed to manage on-chain crypto assets: it reads sBTC balances via an MCP tool or Hiro API, checks wallet connectivity and STX gas, computes an amount to supply to a lending protocol, and emits an MCP command named "zest_supply" with asset and amount parameters. Although it states it "does NOT auto-execute" and only outputs the command payload, the presence of blockchain-specific tools (sbtc_get_balance, zest_get_position, zest_supply), wallet connectivity/gas validation, and an output ready-to-broadcast transaction payload shows the skill's primary purpose is to move crypto funds into Zest. This meets the criterion for direct financial execution (crypto/blockchain operations and transaction-sending capability).

Issues (1)

W009
MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 16, 2026, 06:41 AM
Issues
1