ratepay

Warn

Audited by Snyk on Apr 21, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). The skill is an integration with Ratepay, a payment-processing gateway, and explicitly exposes payment-specific operations (Payment Request, Payment Schedule, Refund). It provides concrete CLI/API mechanisms to execute actions and proxy requests to Ratepay (e.g., membrane action run --connectionId=... ACTION_ID --json and membrane request CONNECTION_ID /path/to/endpoint with HTTP methods including POST). Membrane handles auth and credential refresh server-side, enabling the agent to call Ratepay endpoints (including POST/DELETE/etc.) without needing user-supplied secrets. Because the skill is specifically designed to perform financial operations (create payments, issue refunds, manage payment schedules) and supplies explicit tools/commands to send transactions to a payment gateway, it constitutes direct financial execution capability.

Issues (1)

W009
MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 21, 2026, 10:52 PM
Issues
1