injective-trading-account
Warn
Audited by Snyk on Mar 15, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill is explicitly focused on a crypto trading account (Injective) and exposes/account-maps blockchain-specific operations. Although most listed MCP calls are read-only (account_balances, account_positions, token_metadata), the prompt explicitly references transactional capabilities: it instructs using subaccount_deposit to move funds ("If bank balance has USDT but subaccount doesn't: Use
subaccount_depositto move funds in. NOte that this is not a read/ query, and will involve a transaction.") and refers to "trade tools" and specifying subaccount IDs for trades. Those are explicit crypto/blockchain actions that move funds (transactions/deposits/trades) rather than just generic browsing or HTTP calls. Per the rules (crypto/blockchain wallet and transaction capability), this constitutes Direct Financial Execution authority.
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata