scaffold-project

Warn

Audited by Snyk on Feb 16, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). The skill is explicitly for bootstrapping Aptos blockchain dApps and includes concrete, crypto-specific execution capabilities: it requires a deployer private key (VITE_MODULE_PUBLISHER_ACCOUNT_PRIVATE_KEY), instructs running aptos commands (aptos move init/compile/test) and an npm script to "publish to network" (npm run move:publish) that uses the .env private key. It also references wallet provider setup, aptos client, and transaction payloads (entry-functions). These are specific blockchain wallet/signing and deployment capabilities (crypto transaction execution), not generic tooling—so it grants direct financial/crypto execution authority.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Feb 16, 2026, 12:34 AM