createos-deploy
Warn
Audited by Snyk on Apr 14, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill explicitly implements on-chain payment flow: it requires an EVM wallet, shows code to generate a private key and derive an account, requires signing auth headers, exposes endpoints to check token balances, and instructs the caller to send an ERC-20 transfer (with viem.writeContract) to the provided pay_to address and supply the transaction hash to complete deployment. These are concrete crypto wallet/signing and transaction-sending operations (directly moving tokens), not generic browser/API stubs, so it grants direct financial execution capability.
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata