apto-payments

Warn

Audited by Snyk on Mar 4, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). This skill is a specific integration for Apto Payments, a payments platform for creating/managing branded payment cards, funding sources, transactions, and merchants. It exposes concrete, payment-specific operations via the Membrane CLI:
  • It documents discovering and running connector actions (membrane action run) tied to Apto Payments, not generic browsing or roleplay.
  • It explicitly supports proxying direct API requests to Apto Payments through Membrane with HTTP methods including POST/PUT/PATCH/DELETE and JSON bodies (membrane request ... with -X/--method and --json).
  • The domain (cards, funding sources, transactions) and the ability to invoke write operations to the Apto API constitute direct financial execution capabilities (creating/updating cards, posting transactions, managing funding).

Because the skill's primary and explicit definition is to interact programmatically with a payment platform (including issuing requests that can move or manage funds and payment instruments), it meets the criteria for Direct Financial Execution.

Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 4, 2026, 08:59 AM