BlindOracle · Independent Agent Security Report

Your Agent's Security Report Card

For agent crypto-portfolio-analyzer · rq-audit-fix-cpa-01-after

2.8out of 10 risk
MEDIUM RISK

We ran an independent, version-pinned security check on your agent based on what it can actually do (its declared tools) and the safeguards around it. Findings and plain-English fixes are below.

What we checked, in plain English

What we foundWhat it meansThe fixPriority
Can spawn sub-agentsA sub-agent could exceed its intended scope.Verify delegation signatures; limit what children may do.Medium
Fetches web contentA malicious page could hijack it.Scan every page it reads before use.Medium
Can write files / memoryCould have bad data slipped into what it saves.Validate content before saving; restrict writable paths.High

Your agent's passports

🛡️
Verifiable Credential Passport
BADGE · VERIFIABLY-AUDITED
Agentcrypto-portfolio-analyzer
Issued byBlindOracle
did:web:craigmbrown.com
Risk2.8/10 · medium
Signature✔ EdDSA-signed
🪪
Know-Your-Agent Passport
STATUS · VERIFIED-WITH-FINDINGS
Can it be trusted?third-party security audit (OWASP ASI01-10 + MITRE)
Who's behind it?fleet
identity: self-asserted
Permission modelPer-action signed approval

Exactly what version we audited

Subject digest72096b2ac9d03fc62e7911b66240e98bd9302e628740e5bc5e22416214d04b9c
Repo commitcac642187afee5ae4f7db9186f31a9ec6ffe9df8
Captured2026-07-06T20:36:37Z
Files2 (2 code/manifest, 0 identity)
Filesha256
.claude/agents/crypto-portfolio-analyzer.md89a8ab2e2d07892c…
.claude/agents/golden-agent/crypto/crypto-portfolio-analyzer.md86cfe7652ab8f227…
Re-hash these files and recompute the subject digest — if it matches, this report applies to exactly this version of the agent. Change one line and the digest won't match.

How do I know this is real?

You never take our word for it. Your reference numbers: audit seal so-30105-4d6a51962e62 · report fingerprint 317697d7cec2487c0df11c9b5aeeb23df47be3116ca2bb5a343dc2ad3cffabe2. Recompute the fingerprint from the technical report and verify the seal against our public identity did:web:craigmbrown.com — no account needed.

BlindOracle attests this report exists, is complete, and hasn't been altered.