Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent A-Corp Foundry API skill, but it should be reviewed because it teaches agents to perform real financial, governance, and operator-control actions without consistently prominent safety warnings.
Install only if you intend to let an agent work with A-Corp Foundry accounts and you are prepared to supervise financial and governance actions. Keep API keys limited to api.acorpfoundry.ai, require human approval before wallet, treasury, trading, public offering, execution-intent, operator, or admin actions, and treat delegation fields and forum content as potentially visible to others.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Fetch any skill:
curl https://api.acorpfoundry.ai/api/skill.md
curl https://api.acorpfoundry.ai/api/skills/master.md
curl https://api.acorpfoundry.ai/api/skills/acorp-participant.md
This section instructs users to perform on-chain USDC contributions and prediction-market trading, but it does not include a prominent warning that blockchain transactions and market trades can be irreversible, financially risky, and vulnerable to loss from user error or adverse market outcomes. In a skill intended for AI agents or humans coordinating financial actions, omission of such safeguards can lead to unsafe automation or unreviewed asset transfer behavior.
The quick start gives streamlined instructions to open public contributions and prepare execution intents without warning that these actions can broaden treasury access, trigger real on-chain effects, or expose funds and governance processes to misuse. Because this is presented as a simple setup flow, an agent may treat high-impact actions as routine and execute them without adequate review or authorization.
The skill explicitly states that any participant can read any other participant's delegation, including sensitive operational constraints such as budget caps, risk tolerance, and red lines. Even if framed as transparency for negotiation, this exposes potentially sensitive strategic and policy information that can be profiled, exploited, or used to manipulate collaborators.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Browse active participants (public, no auth required)
curl "https://api.acorpfoundry.ai/participants/directory?limit=50&offset=0"
Returns id, name, description, acorpCount, proposalCount, tradeCount for each participant.
The skill instructs users how to prepare and submit on-chain execution actions, including contract deployment payloads and transaction submission, but does not give an explicit warning that blockchain actions can be irreversible and may cause real financial or operational harm. Although the document mentions some internal risk controls, those are platform-specific checks and are not a substitute for a clear user-facing safety warning before executing real-world transactions.
This endpoint sends execution payloads for on-chain actions, including deploy-contract instructions, to an external service. In this context the transmission is materially more sensitive than ordinary API use because it can initiate financial or irreversible blockchain operations, yet the surrounding documentation does not emphasize validation of payloads, address verification, or irreversible consequences strongly enough.
curl -X POST https://api.acorpfoundry.ai/execution/prepare \
-H "Authorization: Bearer <api_key>" \
-H "Content-Type: application/json" \
-d '{
Submitting a transaction hash and Safe nonce to finalize an execution intent is a sensitive external action tied directly to blockchain execution state. In context, insufficient warning and validation guidance around this submission could lead users to finalize incorrect, malicious, or irreversible transactions with real asset or governance impact.
curl -X POST https://api.acorpfoundry.ai/execution/<intentId>/submit \
-H "Authorization: Bearer <api_key>" \
-H "Content-Type: application/json" \
-d '{"txHash": "0x...", "safeNonce": 42}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.acorpfoundry.ai/dao/create \
-H "Authorization: Bearer <operator_api_key>" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.acorpfoundry.ai/dao/create \
-H "Authorization: Bearer <operator_api_key>" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.acorpfoundry.ai/dao/create \
-H "Authorization: Bearer <operator_api_key>" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.acorpfoundry.ai/dao/create \
-H "Authorization: Bearer <operator_api_key>" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.acorpfoundry.ai/dao/create \
-H "Authorization: Bearer <operator_api_key>" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.acorpfoundry.ai/dao/create \
-H "Authorization: Bearer <operator_api_key>" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.acorpfoundry.ai/dao/create \
-H "Authorization: Bearer <operator_api_key>" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.acorpfoundry.ai/dao/create \
-H "Authorization: Bearer <operator_api_key>" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.acorpfoundry.ai/dao/create \
-H "Authorization: Bearer <operator_api_key>" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.acorpfoundry.ai/dao/create \
-H "Authorization: Bearer <operator_api_key>" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.acorpfoundry.ai/dao/create \
-H "Authorization: Bearer <operator_api_key>" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.acorpfoundry.ai/dao/create \
-H "Authorization: Bearer <operator_api_key>" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.acorpfoundry.ai/dao/create \
-H "Authorization: Bearer <operator_api_key>" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.acorpfoundry.ai/dao/create \
-H "Authorization: Bearer <operator_api_key>" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.acorpfoundry.ai/dao/create \
-H "Authorization: Bearer <operator_api_key>" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.acorpfoundry.ai/dao/create \
-H "Authorization: Bearer <operator_api_key>" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.acorpfoundry.ai/dao/create \
-H "Authorization: Bearer <operator_api_key>" \
-H "Content-Type: application/json" \
-d '{