orderly-onboarding
Warn
Audited by Snyk on Mar 6, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill instructs users to run "npx @orderly.network/mcp-server@latest" (npm: https://www.npmjs.com/package/@orderly.network/mcp-server), which fetches and executes remote code at runtime and provides tools that can directly influence the agent's prompts and behavior, so this is a required runtime external dependency that executes remote code.
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill explicitly exposes crypto trading and asset-movement APIs and tools. It documents endpoints and skills for placing and managing market orders (e.g., POST /v1/order, orderly-trading-orders), deposit/withdraw operations (orderly-deposit-withdraw), wallet integration and signing (EIP-712, Ed25519, orderly-sdk-wallet-connection), and other on-chain settlement workflows. These are specific, purpose-built financial execution capabilities (trading and asset transfers), not generic tooling. Therefore it grants direct financial execution authority.
Audit Metadata