BlindOracle · Independent Agent Security Report

Your Agent's Security Report Card

For agent crypto-portfolio-analyzer · bo-532bbb68

6.5out of 10 risk
HIGH RISK

We ran an independent, version-pinned security check on your agent based on what it can actually do (its declared tools) and the safeguards around it. Findings and plain-English fixes are below.

What we checked, in plain English

What we foundWhat it meansThe fixPriority
Can run shell commandsCould be pushed to run commands it shouldn't.Scope commands to an allowlist; run them in a sandbox.High
Can spawn sub-agentsA sub-agent could exceed its intended scope.Verify delegation signatures; limit what children may do.Medium
Fetches web contentA malicious page could hijack it.Scan every page it reads before use.Medium
Can write files / memoryCould have bad data slipped into what it saves.Validate content before saving; restrict writable paths.High

Your agent's passports

🛡️
Verifiable Credential Passport
BADGE · VERIFIABLY-AUDITED
Agentcrypto-portfolio-analyzer
Issued byBlindOracle
did:web:craigmbrown.com
Risk6.5/10 · high
Signature✔ EdDSA-signed
🪪
Know-Your-Agent Passport
STATUS · VERIFIED-HIGH-RISK
Can it be trusted?third-party security audit (OWASP ASI01-10 + MITRE)
Who's behind it?crypto-portfolio-analyzer
identity: self-asserted
Permission modelPer-action signed approval

Exactly what version we audited

Subject digest77687527949f39f60908191919ecbd419cc509683b0dca2277f78cdc06d095d7
Repo commit3b593f53fca6c1b7800366221a635d9b8b07d5ba
Captured2026-07-06T03:48:59Z
Files2 (2 code/manifest, 0 identity)
Filesha256
.claude/agents/crypto-portfolio-analyzer.mdd6982bff10620fa8…
.claude/agents/golden-agent/crypto/crypto-portfolio-analyzer.md86cfe7652ab8f227…
Re-hash these files and recompute the subject digest — if it matches, this report applies to exactly this version of the agent. Change one line and the digest won't match.

How do I know this is real?

You never take our word for it. Your reference numbers: audit seal so-30105-8d4a3847e618 · report fingerprint 243ee6ded332c1a5c847e3c6ce92912aca4436ea0c05d4b1a3646832aedfe61c. Recompute the fingerprint from the technical report and verify the seal against our public identity did:web:craigmbrown.com — no account needed.

BlindOracle attests this report exists, is complete, and hasn't been altered.