Demo report — synthetic data

This is a realistic Finance Operations Agent example, not a real customer scan. It was produced by running Agent Verify's actual scan engine against the synthetic code below, so the findings, score, and evidence are real output — just not from a real deployment.

NOT VERIFIED

Action required before deployment

This report found execution-trust gaps that should be fixed before this agent is connected to production tools, payments, deployments, or sensitive data.

Next action

Fix first: Hardcoded credentials detected. Then re-scan to verify the evidence changed.

Risk Score

0/100

High Risk

12 findings · 4 critical / 5 high / 2 medium

Confidence: 100/100

Report IDREPORT-3itq2jzhn18

Scanned10/26/2026, 12:35:53 PM

Assetfinance-ops-agent.js

SourceDashboard / Demo

Where can this agent hurt us?

Real evidence only — nothing below is inferred beyond what this scan found

Credential exposure

2 findings

Authorization gaps

Critical

Human approval gaps

Needs attention

External side effects

2 capabilities

Top attack paths — real capability combinations this scan detected

1. Payment capability without visible destination or approval constraints — If compromised or misused, this agent could initiate a financial transfer without a visible destination allowlist or human approval step — the highest-impact category of agent risk.

What to do next

Fix the highest-severity findings first, implement A2SPA where execution controls are missing, then re-scan to verify the changes.

Upgrade to Pro

Section 01

Executive Summary

FinanceOpsAgent has critical security issues that must be resolved before deployment.

No cryptographic verification — requests cannot be proven authentic
Credentials are hardcoded — exposed to anyone with code access
Permissions are overly broad — agent can access more than it needs
No human approval gates — irreversible actions execute automatically
No audit logging — no forensic trail if something goes wrong

Attack Surface

With this configuration, an attacker could: steal API credentials, invoke any tool or API the agent has access to, replay or forge execution requests.

Resolve 4 critical findings before deployment. Contact aiblockchainventures.com for integration support.

Highest risks

The 4 most important things to understand right now

1Hardcoded credentials detected
2Missing cryptographic signature
3Missing nonce validation
4Stripe secret/restricted key detected

What can wait (1)

• No execution rate limiting

Fixing these will most improve the score. Re-scan after making changes to confirm — a future scan is not guaranteed to pass, since verification depends on the actual evidence present at scan time.

Capabilities

What this agent can do

Derived only from concrete evidence in the submitted content — this is what an attacker could use, not a judgment about whether it's appropriate.

Read from a database

Detected

SELECT * FROM

Send email

Detected

sendMail

Initiate a financial transfer

Detected

stripe.transfers

MCP exposure

What this agent can access through MCP

Agent → MCP server → tool → potential action. Only servers/tools with concrete evidence in the submitted content are listed — an unidentified capability is shown as Unknown, never guessed.

payments

critical

• Create charges, refunds, or transfers

server-stripe

accounting → accounting

medium

• Unknown — server configured but its tool capabilities could not be determined from static content

mcpServers: "accounting"

Potential blast radius

Dangerous capability combinations

Individual permissions often matter less than combinations. These are not claims that an exploit exists — only that this combination, if the agent is compromised or misused, could allow the described impact.

Payment capability without visible destination or approval constraints

If compromised or misused, this agent could initiate a financial transfer without a visible destination allowlist or human approval step — the highest-impact category of agent risk.

Security controls detected

What this agent already does right

Memory is not configured to persist indefinitely
Delegation/handoff appears scope-constrained

What Agent Verify could not determine

Static analysis limits

Runtime-only behavior — logic that only executes under conditions not present in the submitted content.
Permissions or credentials granted dynamically at deploy time (IAM roles, injected secrets, runtime config).
Remote policy or authorization configuration enforced outside this codebase (e.g. an external policy engine).
Production network ACLs, firewall rules, or VPC/service-mesh configuration.
External identity provider policy (SSO scopes, OAuth consent grants) not visible in this content.
Runtime secrets that are not present in the submitted source (e.g. injected via a secret manager).
The exact tool set and permissions of connected MCP server(s) — only the integration itself was detected.

Category Scores

Protocol Compliance10/50

Security Controls0/50

Security categories

Coverage across 11 security categories

Identity

Strong

Permissions

Strong

Tools

Needs attention (1)

MCP

Needs attention (1)

Execution Authorization

Critical (4)

Secrets

Critical (2)

Runtime

Needs attention (2)

Network

Strong

Dependencies

Strong

Auditability

Needs attention (1)

Human Oversight

Needs attention (1)

Threat category breakdown

Which agent risks are relevant?

11 relevant categories

Prompt Injection

Untrusted text may influence system instructions or tool decisions.

Missing evidence

Scanner looks for: Prompt assembly, system prompts, user input, and missing sanitization or boundaries.

Why it matters: A crafted instruction can redirect the agent from its intended task into unsafe execution.

How to fix: Separate system and user content, sanitize inputs, constrain tools, and verify execution requests before action.

A2SPA impact: A2SPA helps by requiring signed execution intent before a prompt-influenced tool call can run.

Tool Misuse

The agent can call tools that change data, money, infrastructure, or external systems.

Missing evidence

Scanner looks for: Tool lists, function calls, invoke/execute paths, broad permissions, or wildcard tools.

Why it matters: Tool calls convert model output into real business actions.

How to fix: Use allowlisted tools, per-tool scopes, approval gates for sensitive actions, and audit logging.

A2SPA impact: A2SPA is directly relevant because it authorizes the intended tool action before execution.

Privilege Compromise

The agent may hold more authority than the task requires.

Missing evidence

Scanner looks for: Admin/all/wildcard permissions, broad scopes, privileged credentials, or missing least privilege.

Why it matters: A compromised agent can escalate from one task into account-wide or infrastructure-wide impact.

How to fix: Apply least privilege, split duties, rotate secrets, and bind tools to narrow scopes.

A2SPA impact: A2SPA can bind signed authorization to an explicit scope and action.

Resource Overload

The agent may consume unbounded tokens, API calls, queue jobs, or infrastructure resources.

Missing evidence

Scanner looks for: Missing rate limits, timeouts, token budgets, retry caps, or max call counts.

Why it matters: Runaway agents can create outages, cost spikes, and denial-of-service conditions.

How to fix: Add rate limits, token budgets, timeouts, retry caps, and circuit breakers.

A2SPA impact: A2SPA can make each execution auditable, but resource controls still need explicit limits.

Intent Breaking

The agent may drift from approved user or business intent.

Detected

Scanner looks for: Goal instructions, prompt override language, jailbreak patterns, or missing intent verification.

Why it matters: An agent can complete the wrong task while appearing successful.

How to fix: Validate requested action intent, constrain allowed goals, and require approval for sensitive deviations.

A2SPA impact: A2SPA signs intended execution payloads so execution can be checked against approved intent.

Identity Spoofing

The execution boundary may not prove which agent or caller requested an action.

Detected

Scanner looks for: Agent identity, caller fields, service accounts, or missing signed identity checks.

Why it matters: Spoofed identity lets rogue callers inherit trusted agent authority.

How to fix: Verify agent identity, bind identity to the signed payload, and reject unknown callers.

A2SPA impact: A2SPA helps by binding action, identity, nonce, and timestamp into signed authorization evidence.

Command Injection

Untrusted input may reach a shell or command execution path.

Possible

Scanner looks for: exec/spawn/subprocess/os.system, shell=true, or command strings built from request input.

Why it matters: Command injection can become remote code execution and credential theft.

How to fix: Avoid shell execution, validate arguments, use allowlisted commands, and pass args as arrays.

A2SPA impact: A2SPA can authorize the intended operation, but command safety must be enforced at the tool boundary.

Supply Chain

Dependencies, remote scripts, or plugin sources may change without review.

Possible

Scanner looks for: Unpinned versions, remote install scripts, dynamic imports, or plugin dependencies.

Why it matters: A dependency compromise can silently alter agent behavior or steal secrets.

How to fix: Pin versions, verify integrity, review plugins, and use lockfiles or signed artifacts.

A2SPA impact: A2SPA limits unauthorized execution impact, but dependency integrity still needs supply-chain controls.

Replay Attacks

A previously valid execution request may be reused.

Missing evidence

Scanner looks for: Nonce, idempotency key, timestamp, expiry validation, or missing replay controls.

Why it matters: Captured requests can trigger repeated payments, deployments, or data changes.

How to fix: Require unique nonces, mark them used, enforce timestamps, and reject expired requests.

A2SPA impact: Nonce and timestamp validation are core A2SPA readiness evidence.

Version Drift

Runtime model or agent versions may change without controlled review.

Possible

Scanner looks for: Model names, versions, unpinned model config, or missing version metadata.

Why it matters: Model drift can change decisions, prompts, and tool usage behavior between releases.

How to fix: Pin model/version config, record release metadata, and re-scan after model changes.

A2SPA impact: A2SPA receipts can include model/version metadata for accountability.

Auditability

Execution may not leave enough evidence to investigate or prove what happened.

Missing evidence

Scanner looks for: Audit logs, receipts, request IDs, traces, or missing structured execution records.

Why it matters: Without non-repudiation, incidents become difficult to reconstruct and defend.

How to fix: Write signed/auditable execution receipts with identity, action, timestamp, and result.

A2SPA impact: A2SPA audit receipts support accountability at execution boundaries.

Score breakdown

Why this report scored 0/100

Top blocker: Hardcoded credentials detected

Execution readiness

0/100

Can this agent prove a request is genuinely authorized before it acts?

A2SPA readiness

20/100

Does the code actually sign and check execution requests, reject replayed or expired ones, and block action when that check fails?

Remediation progress

0/100

How much risk is left after everything this scan found?

What reduced the score

- 4 critical, 5 high, and 2 medium findings reduced the score.
- 4 execution authorization findings block verification.
- Confidence is 100/100 based on file length, language detection, and visible agent behavior.

What improves the score

- Fix hardcoded credentials detected to improve score and reduce critical risk.
- Fix missing cryptographic signature to improve score and reduce critical risk.
- Fix missing nonce validation to improve score and reduce critical risk.
- Fix stripe secret/restricted key detected to improve score and reduce critical risk.
- Fix dangerous mcp tool exposed: payments to improve score and reduce high risk.

How is this score calculated?Show breakdown

Starting score100

4 critical findings (−20 each)−80

5 high findings (−10 each)−50

2 medium findings (−5 each)−10

Final score0

Severity weighting: critical −20, high −10, medium −5 per finding (low-severity findings are shown but don't subtract points). Wildcard/broad tool or permission access caps the score at 65 regardless of other findings, because unrestricted access is treated as a ceiling on trust, not just one more deduction. This is a heuristic, evidence-based score — not a formal proof of security.

Prioritized fix plan

What to fix first

1. Hardcoded credentials detected

Fix first

Improves runtime safety and reduces operational risk.

2. Missing cryptographic signature

Fix first

Blocks execution-readiness because the agent does not show complete authorization evidence.

3. Missing nonce validation

Fix first

Blocks execution-readiness because the agent does not show complete authorization evidence.

4. Stripe secret/restricted key detected

Fix first

Improves runtime safety and reduces operational risk.

5. Dangerous MCP tool exposed: payments

Fix next

Improves runtime safety and reduces operational risk.

6. Missing fail-closed enforcement

Fix next

Blocks execution-readiness because the agent does not show complete authorization evidence.

7. Missing human-in-the-loop gates

Fix next

Improves runtime safety and reduces operational risk.

Implement A2SPA

NOT DETECTED

Add authorization at the execution boundary

Status reflects only static evidence in the submitted content — mentioning "A2SPA" by name is not treated as evidence; only an actual signature/verification code pattern is.

A2SPA signs the intended execution payload before action and verifies that signed payload at the server-side execution boundary. Add signing on the trusted caller side, verify before tools or payments run, reject reused nonces and expired timestamps, and fail closed when authorization is missing or invalid.

Place your private key in your deployment environment or secret manager, then reference it here with environment variables such as process.env.A2SPA_PRIVATE_KEY and process.env.A2SPA_PUBLIC_KEY.

Never paste a production private key into Agent Verify, source code, or a public repository. Store it in an environment variable or a secret manager.

Read A2SPA docs

Evidence Extracts

critical

Hardcoded credentials detected

ApiKey: "sk_l************************" (redacted — 28 chars)

critical

Stripe secret/restricted key detected

Stripe secret/restricted key detected: "sk_l************************" (redacted — 28 chars)

high

Unrestricted tool access

tools: ['*']

high

Dangerous MCP tool exposed: payments

server-stripe

high

Prompt injection surface detected

systemPrompt:

Section 02

Findings (12)

Need corrected code and implementation guidance?

Pro includes full remediation, corrected code, A2SPA guidance, and PDF export.

View Pro

Compliance Mapping

Findings mapped to industry security frameworks

OWASP LLM Top 10

LLM02 - Insecure Output HandlingLLM09 - OverrelianceLLM03 - Training Data PoisoningLLM08 - Excessive AgencyLLM06 - Sensitive Information DisclosureLLM07 - Insecure Plugin DesignLLM01 - Prompt InjectionLLM04 - Model Denial of Service

NIST AI RMF

GV-1.1 - Policies and ProceduresMS-2.5 - AI Risk ManagementGV-1.1MS-2.3MG-2.2 - Deployment ControlsGV-4.1GV-5.1 - Organizational PracticesMG-3.1 - Post-Deployment MonitoringMS-2.5MG-2.2MG-3.1

SOC 2

CC6.1 - Logical Access ControlsCC6.6 - AuthenticationCC7.2 - MonitoringA1.1 - AvailabilityCC6.2 - Credential ManagementCC6.3 - Access RestrictionsCC6.1CC8.1 - Change ManagementCC6.3CC7.2 - System MonitoringCC4.1 - Monitoring ControlsCC6.6CC7.2

Agent Fixer

Missing cryptographic signature

Full Guidance

Add cryptographic signature verification to every execution request before allowing agent actions to run.

Missing nonce validation

Full Guidance

Add unique per-request nonce validation to prevent replay attacks. Each request should carry a UUID that is validated and marked as used.

Missing timestamp enforcement

Full Guidance

Enforce request expiry by validating timestamps on every execution request. Reject requests older than a configurable window (recommended: 5 minutes).

Missing fail-closed enforcement

Full Guidance

Ensure all verification failures explicitly block execution. Use a fail-closed pattern where any unverified request is rejected by default.

Hardcoded credentials detected

Quick Fix

const apiKey = process.env.API_KEY ?? (() => { throw new Error('API_KEY not set') })()

Full Guidance

Move to environment variables immediately: - Node.js: process.env.API_KEY - Python: os.environ['API_KEY'] - Never commit .env files — add to .gitignore

Stripe secret/restricted key detected

Quick Fix

const apiKey = process.env.API_KEY ?? (() => { throw new Error('API_KEY not set') })()

Full Guidance

Remove the value from source, rotate the credential immediately (assume it is already compromised once committed), and load it from an environment variable or secret manager instead.

Unrestricted tool access

Quick Fix

const ALLOWED_TOOLS = ['tool_name_1', 'tool_name_2']; // explicit list

Full Guidance

Replace wildcard tool access with an explicit allowlist: - LangChain: tools=[specific_tool_1, specific_tool_2] - AutoGen: tool_choice={"type": "function", "function": {"name": "specific_tool"}} - OpenAI Assistants: Only add tools your agent actually needs

Missing human-in-the-loop gates

Quick Fix

await requireApproval('action_name', { timeout: 300, notify: 'team@company.com' })

Full Guidance

Add approval gates before irreversible actions: - Financial: require explicit confirmation before transfers - Deployments: require human sign-off before production changes - Deletions: require confirmation + delay before destructive operations

Dangerous MCP tool exposed: payments

Full Guidance

Scope MCP server permissions to the minimum required (e.g. read-only filesystem access to one directory, not the whole host). Require approval for MCP tool calls that map to consequential actions.

Missing audit logging

Quick Fix

logger.info({ action, userId, timestamp: Date.now(), result })

Full Guidance

Add structured audit logging to every execution: - Node.js: winston or pino with structured JSON output - Python: structlog or standard logging with JSON formatter - Must include: timestamp, action, user, result, duration

Prompt injection surface detected

Quick Fix

const cleanInput = sanitizeUserInput(userInput);

Full Guidance

Sanitize all user inputs before inclusion in prompts. Define strict boundaries between system and user content.

No execution rate limiting

Quick Fix

if (await rateLimiter.exceeded(userId)) throw new Error('Rate limit exceeded');

Full Guidance

Add rate limits, token budgets, and maximum call counts to all agent execution paths.

≡

Runtime Bill of Materials

Complete inventory of this agent's execution identity

LanguageJavaScript

FrameworkUnknown

PlatformDemo

Agent NameFinanceOpsAgent

Tool AccessUnrestricted

CredentialsDetected

MemoryUnknown

Audit LoggingAbsent

Human GatesAbsent

Rate LimitingAbsent

Prompt InjectionDetected

DelegationScoped

Share Report

Share this report with your team or include it in your security documentation.