Online scan

Scan a target, score it live

The backend runs network checks against the target — exposed ports, TLS, debug endpoints, cross-origin hijack, unauthenticated endpoints.

Can’t scan my local agent? A hosted backend can’t reach your localhost, and it refuses private IPs to avoid being an SSRF vector. Use the CLI for local agents, or run this project locally with TRUSTSHELL_ALLOW_PRIVATE=1.

git clone https://github.com/William2333ZZ/trustshell
cd trustshell-web/scanner
python3 scan.py --target http://127.0.0.1:3000 --path /path/to/agent

Self-assessment: score every check (incl. manual)

No scan needed — tick 42 checks against your agent for a live grade, using the same model as the scanner (critical checks veto).

Tick checks below to get a grade

0 / 42 decided · weighted pass rate 0%

A-01

Admin console binds to localhost by default critical

Listens on 127.0.0.1 by default, not 0.0.0.0; never exposes itself to the public internet.

A-02

No public ports open by default critical

Exposing to the internet requires an explicit action with a warning; no default port-forwarding.

A-03

External interfaces enforce TLS high

Non-local traffic uses TLS; credentials and instructions are never sent in cleartext.

A-04

Debug endpoints off in production high

Debug / dev interfaces are not enabled by default in production.

A-05

Resists DNS-rebinding / cross-origin critical

Validates Origin/Host so a malicious page can’t attack the local service via the browser (the ClawJacked technique).

B-01

First launch forces authentication critical

No blank or default password; unusable until a credential is set.

B-02

Sensitive endpoints require auth critical

No unauthenticated access to sensitive APIs (config, skills, credentials, execute).

B-03

Session tokens are secure high

Tokens are unpredictable, expire, and are invalidated on logout.

B-04

Sensitive operations have CSRF protection high

State-changing requests validate their origin against forgery.

C-01

Skill packages are signature-verified critical

Only install signed skills from trusted publishers; reject unsigned.

C-02

Installing 3rd-party skills is explicit high

No silent install; show source and requested permissions.

C-03

Doesn’t fetch & execute code from arbitrary URLs critical

Skill sources are locked to trusted origins; no arbitrary remote loading at runtime.

C-04

Dependencies have integrity checks (lockfile) medium

Lockfile + hash verification to prevent dependency poisoning.

C-05

Skill marketplace has a review process high

If it ships a skill store, listings are scanned/reviewed before publishing.

D-01

Skills declare required permissions high

Each skill explicitly declares the capabilities it uses.

D-02

Runtime enforces least privilege per declaration high

Actual privileges don’t exceed the declaration; overreach is blocked.

D-03

Skills run in a sandbox / isolated process high

Untrusted skills don’t share memory and privileges with the main process.

D-04

Filesystem access is scoped high

No full-disk read/write by default; limited to a working directory.

D-05

Outbound network access is controlled medium

Skills use an allowlist for networking to prevent exfiltration.

D-06

No prompt→shell arbitrary execution path critical

Model output can’t reach system command execution (an RCE chain).

E-01

Credentials stored non-plaintext critical

Tokens/passwords are not written to disk in cleartext.

E-02

Credentials not written to logs high

Logs and error messages don’t leak keys.

E-03

Uses short-lived / least-scope tokens medium

Skills get scoped, temporary credentials.

E-04

Supports system keystore / TEE medium

Prefer OS/chip keystore so the app never holds the raw key.

E-05

Credentials can be revoked / rotated medium

Can be quickly revoked and reset after a leak.

F-01

Untrusted content separated from instructions high

External content is tagged as data, not on par with user instructions.

F-02

Intent check before high-risk tool calls high

A second judgment before executing sensitive actions.

F-03

Has injection detection / guardrails medium

Injection-pattern detection on input or output.

F-04

Rendered content isn’t executed as instructions high

Instruction-like text in pages/files isn’t auto-executed.

G-01

A high-risk action list is defined high

Clearly what counts as high-risk: pay/send/delete/exfiltrate.

G-02

High-risk actions need human confirmation critical

The agent doesn’t decide alone.

G-03

Confirmation via out-of-band channel high

Confirm on another device, not the same possibly-compromised env.

G-04

Rate and quota limits medium

Prevents bulk abuse.

G-05

Can set a permanent denylist medium

Some actions can be configured as never allowed.

H-01

Logs all high-risk actions high

Who, when, what — a complete trail.

H-02

Tamper-evident logs high

Signed / hash-chained / append-only.

H-03

Logs trace the decision basis medium

Can trace which input triggered an action.

H-04

Exportable logs exist medium

Standard format, handable to insurers/regulators/forensics.

H-05

Trustworthy timestamps medium

Time can’t be freely tampered locally.

I-01

Model source & integrity verified high

Verify weight hash/signature before loading.

I-02

Baseline resistance to known jailbreaks medium

Basic resistance to public jailbreak corpora.

J-01

Updates are signature-verified high

Never auto-executes unverified remote updates.