payment-async-flow
Warn
Audited by Snyk on Apr 14, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). This skill is explicitly about implementing payment connector logic for real payment methods (Boleto, Pix, bank transfers, redirect-based auth). It contains concrete calls and patterns that initiate or authorize payments (e.g., acquirer.initiateAsyncPayment, acquirer.createPixCharge, acquirer.authorizeSyncPayment, acquirer.authorize), handles transaction state (approved/denied/undefined), computes delays tied to payment validity, stores callback URLs and posts back to the gateway using X-VTEX-API-AppKey/AppToken. This is a purpose-built payment/Gateway integration (direct financial execution via payment gateways), not a generic tool, so it meets the "Direct Financial Execution" criteria.
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata