ratepay
Warn
Audited by Snyk on Apr 21, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill is an integration with Ratepay, a payment-processing gateway, and explicitly exposes payment-specific operations (Payment Request, Payment Schedule, Refund). It provides concrete CLI/API mechanisms to execute actions and proxy requests to Ratepay (e.g., membrane action run --connectionId=... ACTION_ID --json and membrane request CONNECTION_ID /path/to/endpoint with HTTP methods including POST). Membrane handles auth and credential refresh server-side, enabling the agent to call Ratepay endpoints (including POST/DELETE/etc.) without needing user-supplied secrets. Because the skill is specifically designed to perform financial operations (create payments, issue refunds, manage payment schedules) and supplies explicit tools/commands to send transactions to a payment gateway, it constitutes direct financial execution capability.
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata