Sponge Wallet

• Analyzed: May 14, 2026, 3:08 AM
• Findings: 1
• Version: 1.0.0
• Hash: ce177d439e1e47771e92920f8988185350fbb8733ec80f4150e2e4d284720965
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its inherently high-risk capabilities, despite aligning with its stated purpose. It enables direct cryptocurrency transfers and swaps (`evm_transfer`, `solana_transfer`, `solana_swap`, `withdraw_to_main_wallet`), which carry significant financial risk. Furthermore, the `sponge` tool allows for web scraping (`task: "crawl"`), document parsing (`task: "parse"`), and sales prospecting (`task: "prospect"`) via external APIs, which could expose or process sensitive information. While these actions are explicitly declared functionalities, they represent broad permissions and powerful primitives that could lead to harm if the agent is compromised or misused. The `scripts/wallet.mjs` file also uses `execSync` for clipboard operations, a powerful primitive, though its use here appears benign with JSON-stringified input.