AgentProof Trust Oracle

• Risk level: Low
• Analyzed: Feb 20, 2026, 6:45 PM
• Findings: 0
• Version: 1.0.0

Overview

The skill is internally consistent with its stated purpose (calling a public oracle API to get agent trust scores), but it comes from an unknown source and the examples assume additional CLI tools not declared — verify the endpoints and tooling before use.

This skill appears to do what it claims: call a public oracle to fetch reputation data. Before using it in production, verify the oracle domain and its trustworthiness (agentproof.sh / oracle.agentproof.sh) — the skill's source and homepage are unknown. Note that example commands use jq and bc even though only curl is declared; ensure jq/bc are present or adjust parsing. Remember that querying the oracle sends agent IDs and deployer addresses to a third party (possible telemetry/tracking); do not send sensitive or private identifiers. For high-value transactions, treat the oracle score as one input among others and manually verify deployer identity and agent behavior. If you need higher assurance, ask the publisher for documentation, security/privacy policy, or an official source repository before relying on automated decisions.