What can go wrong
Why this score?
| Finding | Severity | Places | Risk points |
|---|
Agent assay officeStellar testnet
Before an AI agent gets your keys, Touchmark reads its code, traces what a request can make it do, and stamps the result on Stellar, where anyone can check it.
Elapsed time 0:00
–
Python, JavaScript and TypeScript are traced from what a request says to what the agent signs, pays or fetches. A declared limit the code does not enforce is reported, never credited.
Reworded, split, role-played and planted requests; approval flags the model fills in; a server the requester picks. If only the prompt stops it, it is not stopped.
A Soroban contract issues the credential only for a validated report: bound to its hash, its score of 65 or more, and the version that was tested.
The quick test answers one question fast. The Studio is for the agent you cannot hand over as a public link, and for the review you want to keep.
Nº 01 · The counter this page
Nº 02 · The back room Studio
.tmark you are still drafting