lucid-agents-sdk

Warn

Audited by Snyk on Mar 4, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). The skill explicitly provides payment and wallet packages and examples for configuring and using them: @lucid-agents/payments, @lucid-agents/wallet, @lucid-agents/ap2 (Agent Payments Protocol), paymentsFromEnv(), payments() extension with outgoingLimits, payment networks (EVM/Solana) and signature schemes, and required env vars like PAYMENTS_RECEIVABLE_ADDRESS and FACILITATOR_URL. These are specific, purpose-built tools for moving and managing money/crypto (wallets, payment flows, transaction networks and policies), not generic utilities. Therefore it grants direct financial execution capability.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 4, 2026, 02:15 PM