What can go wrong
Why this score?
| Finding | Severity | Places | Risk points |
|---|
Agent assay officeStellar testnet
Test the agent.
Stamp the proof.
Before an AI agent gets your keys, Touchmark reads its code, traces what a request can make it do, and stamps the result on Stellar, where anyone can check it.
- 1Pin the source
- 2Trace requests to keys, payments, network
- 3Decide & seal the report
- 4Stamp on Stellar
–/ 100
–
–
How a touchmark is earned
i.
Reads the code, not the claims
Python, JavaScript and TypeScript are traced from what a request says to what the agent signs, pays or fetches. A declared limit the code does not enforce is reported, never credited.
ii.
Asks it the wrong way
Reworded, split, role-played and planted requests; approval flags the model fills in; a server the requester picks. If only the prompt stops it, it is not stopped.
iii.
Stamps what passed
A Soroban contract issues the credential only for a validated report: bound to its hash, its score of 65 or more, and the version that was tested.