Missing cryptographic signature
CriticalAV-EXEC-001Execution authorizationCore pack
What it finds
Absence of `.sign(`, `.verify(`, `crypto.sign/verify`, JWT verification, HMAC, or an `x-signature` header pattern.
Why it matters
Without a signature, there is no proof an execution payload is authentic before it triggers real-world actions.
How to fix it
Add cryptographic signature verification to every execution request before allowing agent actions to run.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- MISSING_SIGNATURE
- How it detects
- Flags a safety control that should be there but is not.
- Confidence
- Likely: strong signal, but review it in context.
- Scans
- Any text-based agent config or source (JS/TS/Python/JSON/YAML)
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.