apto-payments
Warn
Audited by Snyk on Mar 4, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). This skill is a specific integration for Apto Payments, a payments platform for creating/managing branded payment cards, funding sources, transactions, and merchants. It exposes concrete, payment-specific operations via the Membrane CLI:
- It documents discovering and running connector actions (membrane action run) tied to Apto Payments, not generic browsing or roleplay.
- It explicitly supports proxying direct API requests to Apto Payments through Membrane with HTTP methods including POST/PUT/PATCH/DELETE and JSON bodies (membrane request ... with -X/--method and --json).
- The domain (cards, funding sources, transactions) and the ability to invoke write operations to the Apto API constitute direct financial execution capabilities (creating/updating cards, posting transactions, managing funding).
Because the skill's primary and explicit definition is to interact programmatically with a payment platform (including issuing requests that can move or manage funds and payment instruments), it meets the criteria for Direct Financial Execution.
Audit Metadata