skills/vm0-ai/vm0-skills/sponge/Gen Agent Trust Hub

sponge

Pass

Audited by Gen Agent Trust Hub on Jun 14, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill acts as a documentation and implementation layer for the Sponge financial infrastructure, with no malicious patterns detected.
  • [COMMAND_EXECUTION]: Uses standard curl and jq commands to interact with REST endpoints at api.wallet.paysponge.com. The shell examples are transparent and perform only the documented financial operations.
  • [CREDENTIALS_UNSAFE]: Secret management is handled correctly via environment variables (SPONGE_MASTER_KEY). The skill explicitly instructs against hardcoding keys and recommends using a secure connector for credentials.
  • [EXTERNAL_DOWNLOADS]: References official SDKs (@paysponge/sdk and paysponge) but does not perform any runtime remote script execution or unverified package installations.
  • [DATA_EXFILTRATION]: All network requests are directed toward the service's primary API. There is no evidence of local file access, environment harvesting, or data transmission to unauthorized domains.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 14, 2026, 01:52 AM
Security Audit — agent-trust-hub — sponge