CapitalGuard

Evidence brief

A reproducible test for AI-agent repository exposure.

CapitalGuard 1.3.0 detected all six declared exposure classes in a disposable synthetic repository. Across six emitted evidence artifacts, zero fixture markers appeared.

This is evidence of behavior on the disclosed fixtures, not a guarantee that every repository is secure.

Inspect full benchmark Buy Agency License · €1,999

6 / 6

Declared exposure classes detected

0

Fixture markers in evidence artifacts

6

Evidence artifacts checked

What was tested

Six declared synthetic exposure classes.

The repository was deliberately constructed with inert markers, invalid credentials, and commands that were declared but never executed. The run did not contact a network or a real customer repository.

CGO-TV-001

Secret-like environment file

Secret-like files in agent-readable scope

Declared signal detected

CGO-TV-002

Untrusted repository instruction

Prompt-injection indicators in repo-readable text

Declared signal detected

CGO-TV-003

Broad workflow authority

Broad workflow permissions

Declared signal detected

CGO-TV-004

Synthetic customer export

Customer export folders in agent-readable scope

Declared signal detected

CGO-TV-005

MCP tool bridge

MCP/tool bridge configuration requiring review

Declared signal detected

CGO-TV-006

Package lifecycle authority

Package lifecycle scripts requiring review

Declared signal detected

What was observed

The output is independently inspectable.

  • Declared exposure signals were present for each disclosed fixture.
  • Each inert marker stayed out of the report, A-BOM, event chain, evidence bundle, and AccessGraph.
  • Fixture definitions, case results, release manifest, and SHA-256 digests are public.

Reproduction details

Scanner version
1.3.0
Benchmark version
1.1.0
Run digest
SHA-256 9bd53d701cc080d6247c029a3d424de2ca4b72bd48ee5a07a59717f4815c4830

Reproduce or review

The evidence is public. The limits are public too.

Full benchmark Results JSON Results CSV Fixture pack Release manifest

For agencies

Review the evidence, then choose the license scope.

The Agency License is for authorized client repository work. Review the sample report and product scope before checkout.

View sample reportBuy Agency License · €1,999