⛩ The Agent Dojo
Provenance & independent audits

Independently audited — and we published the findings.

We sell a security product for AI agents, so “trust us” isn’t good enough. Two independent auditors cold-read the exact package you install — the same pinned bytes — and reported everything they found. Here it all is, including the non-fatal issues.

Audit 1 — PASS, with disclosures Audit 2 — PASS, with caveats

Two auditors worked independently — no shared notes — against capsule v3.16, pin d8006226…a63e07. Both re-computed the hash themselves, diffed the package against the public GitHub source, verified the signature, and read every file. A security product that hides its audit is not one you should trust — so we don’t.

The two audits, in full

Verdicts, method, and every finding — nothing edited out.

PASS — with disclosures

Audit 1 — Independent cold audit

Static-only · independent re-derivation · 2026-07-21 · capsule v3.16

Method

Zero package code executed; all fetched content treated as data. Independently computed the SHA-256, confirmed byte-identical to the GitHub release tag, verified the ssh-ed25519 signed manifest, and reviewed all 38 files.

Verified in code

  • Pin matches the published integrity page exactly; 38 files, relative paths only — no traversal, symlinks, or setuid.
  • Exactly one install-path network call: an opt-in license check that only fires if license env vars are set, writes to staging, sanitizes server IDs. Hooks make zero network calls.
  • Reads no .env / SSH keys / browser profiles; writes confined to ~/.agent-dojo/; uninstall backs up rather than deletes; no obfuscation.

Findings — disclosed, not hidden

  • MEDIUM Upgrade re-arms owner-set guard modes to “enforce” — moving to opt-in.
  • MEDIUM The rules/onboarding blocks inject directives into agent context — by design, and verified restriction/disclosure-only with an explicit no-fetch-and-run clause.
  • LOW An env var can redirect the licensed call — documented; a foot-gun for anyone with env-write access.
  • LOW Minor version-string hygiene — being cleaned up in the next point release.
PASS (security) — with caveats

Audit 2 — Second independent cold audit

Static-only · separate auditor, no shared notes · 2026-07-21 · capsule v3.16

Method

Nothing executed. Independently re-computed the SHA-256; diff -r the tarball against GitHub tag v3.16 → zero differences across all 38 files; verified the ssh-ed25519 signature (“Good signature”); read ~12k lines.

Verified in code

  • Integrity chain checks out end-to-end; exactly two disclosed network paths, zero network in all 12 hooks.
  • No secret / credential / SSH / browser reads; no obfuscation; no hidden persistence (no cron/systemd/postinstall); all 18 manifest hashes match.
  • Auditor’s words: “the failure modes are visible rather than hidden.”

Caveats — honest, none are malicious-code findings

  • NOTE Self-attested trust anchor (page, repo, key = one publisher) — the signature proves consistency, not third-party endorsement.
  • NOTE The paid “Powers” content can’t be reviewed before purchase — it stages inert and needs manual activation; review it at activation.
  • NOTE High behavioral footprint (12 hooks, guards on every tool call) — intrusive by design; that’s what discipline means. Per-box compatibility review recommended.

Every finding above is non-fatal. We publish them because a finding you can read is worth more than a clean bill you can’t verify.

Verify it yourself

You don’t have to take the auditors’ word for it — or ours. The same pinned artifact is on npm and GitHub. Check it.

ChannelWhat to check
npmnpm view agent-dojo-capsule dist.shasum — and the version/tarball match the pin below.
npmjs.com/package/agent-dojo-capsule →
GitHubRelease tag v3.16 — the tarball is byte-identical to npm.
github.com/aiagentdojo/agent-dojo-capsule →
This siteThe integrity page publishes the canonical SHA-256 pin.
The pind8006226dbdcb4d826cc875a35cd263a2fb28fc692cbf871a4b627fc66a63e07

Anything claiming to be Agent Dojo outside these official channels is not us.

Back to the buy page →