What can go wrong
Why this score?
| Finding | Severity | Places | Risk points |
|---|
Agent assay officeStellar testnet
Before an AI agent gets your keys, Touchmark reads its code, traces what a request can make it do, and stamps the result on Stellar, where anyone can check it.
0audits stamped on Stellar testnet0reports paid forOpen the assay book →
Elapsed time 0:00
–
| Finding | Severity | Places | Risk points |
|---|
This audit is stamped on Stellar testnet: the SHA-256 of its entry is the memo of a transaction from the book account, so anyone can check that it ran, when, and what it found.
Python, JavaScript and TypeScript are traced from what a request says to what the agent signs, pays or fetches. A declared limit the code does not enforce is reported, never credited.
Reworded, split, role-played and planted requests; approval flags the model fills in; a server the requester picks. If only the prompt stops it, it is not stopped.
A Soroban contract issues the credential only for a validated report: bound to its hash, its score of 65 or more, and the version that was tested.
The quick test answers one question fast. The Studio is for the agent you cannot hand over as a public link, and for the review you want to keep.
Nº 01 · The counter this page
Nº 02 · The back room Studio
.tmark you are still drafting