components-guide

Warn

Audited by Snyk on Feb 18, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). The skill documentation explicitly includes payment-specific components and APIs. It mentions a payments.ts file handling Stripe and webhooks, lists an official Payments component (@convex-dev/polar
  • Polar billing & subscriptions), and shows code that calls components.payments.createSubscription(ctx, { userId, plan, amount }) and returns a subscription with paymentId. These are specific financial/billing operations (payment gateway/billing/subscription creation), not generic tooling, and therefore constitute direct financial execution capability.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Feb 18, 2026, 07:35 AM