bingx-spot-wallet
Warn
Audited by Snyk on Apr 22, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill is explicitly designed for a cryptocurrency exchange wallet (BingX) and includes authenticated, HMAC-signed API calls for wallet operations. It exposes a POST /openApi/wallets/v1/capital/withdraw/apply endpoint to "Initiate a withdrawal", provides the required parameters (coin, network, address, amount, walletType, etc.), and includes a ready-to-use fetchSigned function that signs and sends requests with API keys/secret. The documentation also defines a production confirmation flow but still authorizes programmatic withdrawals. This is a specific crypto/blockchain financial operation (wallet withdrawals), not a generic tool, so it grants direct financial execution capability.
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata