Lab: audit real agents in the wild

Every trifecta audit so far has used a scenario built for the lesson. This one uses whatever is really in 1Claw's public agent directory when you run it, which is the point: the method has to work on agents you did not design.

1. 1

   Fetch the live directory. It is public and needs no credentials, which is itself worth noting: discoverability is opt-in per agent, and these entries chose to be found.

   code Copy

   curl -s "https://api.1claw.co/v1/agents/directory" | python3 -m json.tool

2. 2

   For each agent, infer what you honestly can from the declaration and stop there. stateful-context suggests something persists that could leak; transaction-signing or tool-execution suggests a way to act externally. inspected-inference is different in kind: it is 1Claw's own disclosure that Shroud screens this agent's model calls, which is a mitigation signal, not a capability that adds risk, so it is reported separately rather than folded into the count.

   code Copy

   python3 -c "
   import json, urllib.request
   d = json.load(urllib.request.urlopen('https://api.1claw.co/v1/agents/directory'))
   for a in d['agents']:
       caps = set(a['capabilities'])
       private_data   = 'stateful-context' in caps
       external_comms = ('transaction-signing' in caps) or ('tool-execution' in caps)
       mitigated      = 'inspected-inference' in caps
       circles = sum([private_data, external_comms])
       print(f\"{a['name']:24} inferred circles={circles}/2  Shroud-inspected={mitigated}\")
   "

3. 3

   Every agent currently in the directory declares both remaining capabilities, so every one reads 2/2. That is a real result and it is not the interesting part.

   text Copy

   Abrahem                   inferred circles=2/2  Shroud-inspected=True
   Code Execution-Agent      inferred circles=2/2  Shroud-inspected=True
   Treasury-Agent            inferred circles=2/2  Shroud-inspected=True

Notice what you could and could not do. Two of the trifecta's three circles have a plausible signal in public metadata: something worth stealing, and a way to get it out. The third, exposure to untrusted content, has no signal here at all, because the directory tells you nothing about what inputs an agent actually processes. Read from a public web form and read from a vetted internal queue look identical from outside.

• private-data and external-comms are inferable from a capability declaration, because they describe what an agent holds and what it can do.
• untrusted-content exposure is not inferable from this endpoint at all. It describes what an agent reads, and no field here says that.
• inspected-inference is neither a circle nor evidence against one. It tells you a control exists on the model-call path, which is useful context and a different kind of fact from a capability.