icrc-ledger

Warn

Audited by Snyk on Mar 11, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). This skill is explicitly a token ledger integration and includes concrete, purpose-built primitives for moving value: icrc1_transfer (sendTokens/send_tokens), icrc2_approve (approveSpender/approve_spender), and icrc2_transfer_from (transferFrom/transfer_from). The documentation and code show direct calls to mainnet ledger canisters (with specific canister IDs and fee values) and CLI examples that perform transfers on ICP/ckBTC/ckETH. These are not generic I/O or navigation tools — they are explicit APIs to send tokens, set allowances, and execute transferFrom operations, i.e., direct financial execution.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 11, 2026, 07:18 AM