🛡️ Agent Audit — Before/After: crypto-portfolio-analyzer
Live re-audit, 2026-07-06 · RQ-AUDIT-FIX-CPA-01 · same audit pipeline
(agent-audit-for-owner) run twice against two real versions of the same fleet agent
— this page IS the audit→fix→re-audit loop BlindOracle sells as a product.
What changed: the agent's manifest declared
Bash with zero documented
mitigations. Least-privilege review found the agent's own workflow never shells out — every
processing step is a Task sub-agent call or in-context aggregation — so Bash
was removed, and the controls the agent genuinely inherits (content-trap scanning on
WebSearch, HMAC-verified Task delegation) were documented truthfully in a new
## Security Posture section. No mitigation was claimed without a grep-provable
enforcement path.
6.5/10
Risk — before
2.8/10
Risk — after
HIGH → MEDIUM
Risk level
4 → 3
Findings
Findings — before vs after
| Finding | ASI | Severity | Before | After |
|---|---|---|---|---|
Shell / command-execution capability (CAP-BASH) | ASI02 | HIGH | present | removed — Bash dropped from tools |
Filesystem / memory write capability (CAP-WRITE) | ASI05 | HIGH | present | present — now documented as gated to the single final report write |
Sub-agent delegation capability (CAP-DELEGATE) | ASI03 | MEDIUM | present | present — now documented as HMAC-verified (RQ-132) |
External web-fetch capability (CAP-WEB) | ASI01 | MEDIUM | present | present — now documented as content-trap scanned (RQ-173) |
Result: risk score dropped 57% (6.5 → 2.8), risk level HIGH → MEDIUM, and the highest-severity
finding (unscoped Bash) was eliminated outright — not hidden, not reworded. The two remaining findings
carry documented, grep-verifiable mitigations rather than being argued away.
Read the full reports
Each is the same passport-bearing friendly report format BlindOracle ships to every audit customer — subject digest, file hashes, and an audit seal you can independently recompute.
📄 Before report (6.5/10 HIGH) 📄 After report (2.8/10 MEDIUM)Verify it yourself
- Manifest diff:
.claude/agents/crypto-portfolio-analyzer.md—tools:line droppedBash, and a new## Security Posturesection cites the enforcing files for each remaining capability. - Re-audit assertion: new subject digest (
72096b2a…, ≠ the original77687527…) proves the audited version actually changed. - Honesty check: every credited mitigation (
content_trap, HMAC, allowlist) has a grep-provable enforcement path in.claude/hooks/pre_tool_use.pyandscripts/content_trap_scanner.py— no keyword was added without a real control.