sponge
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill acts as a documentation and implementation layer for the Sponge financial infrastructure, with no malicious patterns detected.
- [COMMAND_EXECUTION]: Uses standard
curlandjqcommands to interact with REST endpoints atapi.wallet.paysponge.com. The shell examples are transparent and perform only the documented financial operations. - [CREDENTIALS_UNSAFE]: Secret management is handled correctly via environment variables (
SPONGE_MASTER_KEY). The skill explicitly instructs against hardcoding keys and recommends using a secure connector for credentials. - [EXTERNAL_DOWNLOADS]: References official SDKs (
@paysponge/sdkandpaysponge) but does not perform any runtime remote script execution or unverified package installations. - [DATA_EXFILTRATION]: All network requests are directed toward the service's primary API. There is no evidence of local file access, environment harvesting, or data transmission to unauthorized domains.
Audit Metadata