qrcoin
Warn
Audited by Snyk on Feb 20, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill is explicitly designed to perform crypto financial operations. It lists blockchain contract addresses (auction contract and USDC on Base), requires a wallet PRIVATE_KEY, and exposes commands that create on-chain transactions: "/qr bid" (creates a bid requiring ~11 USDC), "/qr contribute" (contribute ~1 USDC), and "/qr approve " (ERC-20 token approval). These are direct operations to move or authorize funds on-chain (signing/sending transactions), not generic tooling. Therefore it grants direct financial execution capability.
Audit Metadata