sanctum
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns such as prompt injection, obfuscation, or unauthorized data exfiltration were detected. The skill's behavior aligns with its stated purpose of providing DeFi integration tools.
- [EXTERNAL_DOWNLOADS]: The skill interacts with external APIs at
sanctum-api.ironforge.networkandsanctum-s-api.fly.devto fetch token metadata and unsigned transaction data. These are legitimate endpoints for the Sanctum protocol, and the use of the Ironforge infrastructure provider is a standard practice in the Solana ecosystem. - [COMMAND_EXECUTION]: The skill provides code to sign and broadcast transactions to the Solana network. This is the primary intended purpose of the skill, and the implementation uses the well-known
@solana/web3.jslibrary. The logic is transparent and involves local signing of transactions fetched from the protocol API. - [CREDENTIALS_UNSAFE]: The skill correctly handles sensitive information by using environment variable placeholders (e.g.,
process.env.SOLANA_PRIVATE_KEY) in its templates and placeholders for API keys in its documentation, adhering to secret management best practices.
Audit Metadata