sbtc-auto-funnel
Warn
Audited by Snyk on Apr 16, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill is explicitly designed to manage on-chain crypto assets: it reads sBTC balances via an MCP tool or Hiro API, checks wallet connectivity and STX gas, computes an amount to supply to a lending protocol, and emits an MCP command named "zest_supply" with asset and amount parameters. Although it states it "does NOT auto-execute" and only outputs the command payload, the presence of blockchain-specific tools (sbtc_get_balance, zest_get_position, zest_supply), wallet connectivity/gas validation, and an output ready-to-broadcast transaction payload shows the skill's primary purpose is to move crypto funds into Zest. This meets the criterion for direct financial execution (crypto/blockchain operations and transaction-sending capability).
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata