components-guide
Warn
Audited by Snyk on Feb 18, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill documentation explicitly includes payment-specific components and APIs. It mentions a payments.ts file handling Stripe and webhooks, lists an official Payments component (@convex-dev/polar
- Polar billing & subscriptions), and shows code that calls components.payments.createSubscription(ctx, { userId, plan, amount }) and returns a subscription with paymentId. These are specific financial/billing operations (payment gateway/billing/subscription creation), not generic tooling, and therefore constitute direct financial execution capability.
Audit Metadata