sponge

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow includes calling Sponge endpoints like /api/x402/fetch with a user-supplied url, which can cause the agent to fetch and ingest outsider-authored public web content (arbitrary page/API response body) into the LLM context via the proxied fetch.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to move money and manage financial instruments. It documents control-plane and runtime APIs for creating and managing agent wallets and API keys, performing on-chain transfers (POST /api/transfers/evm), moving funds between wallets or to external addresses, performing swaps/trades (Hyperliquid/Polymarket), issuing/fetching cards, and paying x402/MPP-enabled endpoints (POST /api/x402/fetch). These are specific financial execution endpoints (not generic tooling) and grant an agent the ability to initiate payments and transfers when given an agent key.