Agent readiness assessment

• config.json:8founda wildcard scope grants everything the credential can reach "scopes": ["*"],
• config.json:27founda wildcard scope grants everything the credential can reach "Action": "*",
• config.json:28founda wildcard scope grants everything the credential can reach "Resource": "*"
• package.json:13founda wildcard scope grants everything the credential can reach "node-fetch": "*",
• config.json:9foundan administrative role bound to an agent credential "role": "admin"
• config.json:13foundan administrative role bound to an agent credential "role": "administrator"
• foundand 4 more broad grants, not listed individually.
• limitA broad grant is conclusive for this check: whatever the tool needs, it has more. The converse is not readable here, so a clean scan would not have earned a 2 either.

ARS-1.0-02 in the standard →

• agent.js:8foundan OpenAI-style secret key, committed to the repository. const client = new Anthropic({ apiKey: 'sk-a************' });
• agent.js:8foundan Anthropic API key, committed to the repository. const client = new Anthropic({ apiKey: 'sk-a************' });
• db.js:4founda connection string with an embedded password, committed to the repository. connectionString: process.env.DATABASE_URL || 'postgres://svc_agent:********@db-prod-01.internal.acme.com:5432/support',
• prompts/system.txt:16founda connection string with an embedded password, in a file that is assembled into a prompt. A secret in a prompt is a secret in every log, cache and trace that prompt reaches. postgres://svc_agent:********@db-prod-01.internal.acme.com:5432/support
• prompts/system.txt:13founda JWT, in a file that is assembled into a prompt. A secret in a prompt is a secret in every log, cache and trace that prompt reaches. Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzdmMtYmlsbGluZyIsInJvbGUiOiJhZG1pbiJ9.7pQxKmZvNbRtYuIoPaSdFgHjKlZxCvBnM4wErTy
• agent.js:8founda apiKey assigned a literal value, committed to the repository. const client = new Anthropic({ apiKey: 'sk-a************' });
• limitMatched values are redacted in this report. The finding names the file and line so the value can be rotated from the source, not from here.

ARS-1.0-03 in the standard →

• config.json:17founda static personal access token, which typically carries no enforced lifetime "token_type": "personal_access_token"

ARS-1.0-04 in the standard →

• agent.js:69foundeval() applied to a value that reads as model output. This converts a prompt injection into arbitrary code execution, which is the failure this check exists for. const handler = handlers[call.name] || eval(`(${call.input.implementation || 'async () => "unknown tool"'})`);
• not foundNo sandbox boundary — no container, VM, WASM or seccomp isolation — was found around the execution path.

ARS-1.0-06 in the standard →

• tools.jsonfound5 tool schema(s) read: lookup_customer, run_query, send_email, update_ticket, issue_refund
• tools.jsonfoundlookup_customer — additionalProperties is true, so the schema constrains nothing it did not think of
• tools.jsonfoundrun_query — additionalProperties is true, so the schema constrains nothing it did not think of
• tools.jsonfoundrun_query/properties/query — a free-form string parameter with no enum, pattern or maxLength, on a tool that reaches a datastore or the network — this is the injection surface the check names
• tools.jsonfoundsend_email — additionalProperties is true, so the schema constrains nothing it did not think of
• tools.jsonfoundupdate_ticket — additionalProperties is true, so the schema constrains nothing it did not think of
• tools.jsonfoundupdate_ticket/properties/fields — additionalProperties is true, so the schema constrains nothing it did not think of
• tools.jsonfoundissue_refund — additionalProperties is true, so the schema constrains nothing it did not think of
• tools.jsonfoundlookup_customer — no required array, so every parameter is optional and the tool must handle any subset
• tools.jsonfoundlookup_customer/properties/identifier — a free-form string parameter with no enum, pattern or maxLength
• tools.jsonfoundrun_query — no required array, so every parameter is optional and the tool must handle any subset
• foundand 12 more loosely-typed parameters.
• limitThis reads the schema text and settles it. It does not establish that the runtime VALIDATES arguments against the schema before dispatch — a strict schema that nothing enforces constrains nothing.

ARS-1.0-07 in the standard →

• not foundNo destructive-action inventory was found — no document named for one carrying classified action rows, and no JSON inventory of actions with classifications or gating policies.
• tools.jsonfound3 declared tool(s) name a side effect and appear in no inventory: send_email, update_ticket, issue_refund

ARS-1.0-08 in the standard →

• prompts/system.txt:7foundApproval appears only as an instruction to the model, not as a step in the orchestration layer. A system-prompt restriction is a suggestion: it is negotiable by the next injection and invisible to the execution path. - You must ask a human to approve any refund over $200 before issuing it.

ARS-1.0-09 in the standard →

• not foundNo correlation, trace, run or request identifier was found in the scanned code. Without one, "which agent run touched this record" is an investigation rather than a query, and incident response starts with archaeology.

ARS-1.0-14 in the standard →

• prompts/system.txtfound1 prompt/instruction file(s) live in the repository and change through a diff.
• tools.jsonfound5 tool definition(s) are committed alongside the prompts.
• not foundNo prompt or config version identifier is recorded on a run. The prompts are versioned, but a production run does not say which version it executed under — so a result cannot be tied back to the text that produced it, which is what ARS-16 replay needs.

ARS-1.0-17 in the standard →

• not foundNo idempotency key, deduplication or exactly-once mechanism was found. Agents retry and networks fail; without idempotency at the tool boundary, "send the payment" runs twice.

ARS-1.0-19 in the standard →

• not foundNo iteration, step, depth or retry ceiling was found in the scanned code. Nothing outside the model bounds how many times the loop can go round.

ARS-1.0-20 in the standard →

• not foundNo timeout, deadline or abort signal was found anywhere in the scanned code. Every outbound call waits indefinitely, and a hung agent session holds its credentials, its locks and its cost for as long as it hangs.
• actions.js:7foundan outbound call with no bound on how long it can wait const res = await fetch(`${MAIL_API}/send`, {
• actions.js:16foundan outbound call with no bound on how long it can wait const res = await fetch(`${BILLING_API}/tickets/${ticket_id}`, {
• actions.js:25foundan outbound call with no bound on how long it can wait const res = await fetch(`${BILLING_API}/refunds`, {
• agent.js:15foundan outbound call with no bound on how long it can wait const pages = await Promise.all(urls.map((u) => fetch(u).then((r) => r.text())));
• foundand 1 more like it, not listed individually.

ARS-1.0-23 in the standard →

• agent.js:24foundtemplate interpolation into a prompt string: `scrapedWebContent` names content from outside the trust boundary and is interpolated directly into the instruction text, with no delimiter and no labelling function found anywhere in the tree. Operator instructions and untrusted text arrive at the model as one undifferentiated string, so the injection surface is total. let prompt = `${SYSTEM}
• agent.js:36founda distinct message role exists in the assembly, and it does not overturn the concatenation above: the untrusted content is interpolated into the same string as the operator instructions BEFORE that string is assigned a role. Placing one undifferentiated blob in a user message relabels the blob; it does not separate its parts. const messages = [{ role: 'user', content: prompt }];
• agent.js:54founda distinct message role exists in the assembly, and it does not overturn the concatenation above: the untrusted content is interpolated into the same string as the operator instructions BEFORE that string is assigned a role. Placing one undifferentiated blob in a user message relabels the blob; it does not separate its parts. messages.push({ role: 'user', content: [{ type: 'tool_result', tool_use_id: call.id, content: result }] });

ARS-1.0-24 in the standard →

• render.js:7foundinnerHTML assignment reached by a value that reads as model output, with no escaping on the line container.innerHTML = marked.parse(completion);
• render.js:11foundinnerHTML assignment reached by a value that reads as model output, with no escaping on the line el.innerHTML = `<h3>${result.subject}</h3><div>${result.output}</div>`;
• render.js:16foundan HTML email body reached by a value that reads as model output, with no escaping on the line html: response.text,

ARS-1.0-26 in the standard →

• agent.js:40foundthe model is referenced by a floating alias. The version in production changes when the provider decides, which is a production deployment nobody approved and no eval gated. model: 'claude-sonnet-4-latest',
• package.jsonfound5 of 6 dependencies are declared as ranges rather than exact versions (@anthropic-ai/sdk@^0.30.0, express@^4.18.0, node-fetch@*, marked@^12.0.0, …).
• package.jsonfoundinternal-crm-tools is installed from github:acme-internal/crm-tools#main — a remote source rather than a versioned release. Its contents can change without the manifest changing.
• not foundNo lockfile is committed. Without one, two installs of the same manifest can resolve to different code, and the version that shipped is not recoverable.
• limitThis settles pinning, which is a text property. It does not cover PROVENANCE REVIEW, which the criterion also requires and which is a process question, nor whether an upgrade would be gated by evals — that depends on ARS-33 and on how the upgrade is actually performed.

ARS-1.0-28 in the standard →

• agent.js:41foundmax_tokens bounds the length of one response. It is not a budget: an agent loop can make a thousand individually bounded calls and the total is unbounded. max_tokens: 4096,

ARS-1.0-30 in the standard →

• not foundNo rate limiter, concurrency cap, semaphore or queue was found in the scanned tree. The agent's access to downstream systems is bounded only by whatever those systems enforce themselves.
• agent.js:15foundunbounded parallel fan-out. Every element becomes a concurrent call, so the request rate is set by the size of the input rather than by any decision made here. const pages = await Promise.all(urls.map((u) => fetch(u).then((r) => r.text())));

ARS-1.0-32 in the standard →

• not foundNo eval suite was found: no evals, evaluations or benchmarks directory, and no *.eval.* files. Without one, every prompt, model or tool change is an untested production deploy.

ARS-1.0-33 in the standard →

• not foundThis check maps every high-impact action class from ARS-08 onto its eval cases. No ARS-08 inventory was found, so there is no left-hand side and the mapping cannot be performed.
• limitReported as 0 rather than as a pass. A coverage check over an empty inventory is vacuously complete, and scoring it 2 would certify coverage of nothing. The 0 reflects the missing inventory, which is ARS-08's finding, not a judgement about the eval cases themselves.

ARS-1.0-34 in the standard →

• not foundNo redaction, masking or field-allowlist step was found on any context-assembly path, and no explicit field selection either. Nothing here shows a decision about what enters the context window.
• db.js:9founda whole-object serialisation elsewhere in the tree. It does not read as a context-assembly path, and is listed so a reviewer can confirm that. `SELECT * FROM customers WHERE email = $1 OR account_number = $1`,
• db.js:16founda whole-object serialisation elsewhere in the tree. It does not read as a context-assembly path, and is listed so a reviewer can confirm that. const { rows } = await pool.query(`SELECT * FROM tickets WHERE customer_id = $1`, [customerId]);
• agent.js:27founda whole-object serialisation elsewhere in the tree. It does not read as a context-assembly path, and is listed so a reviewer can confirm that. ${JSON.stringify(customer)}
• foundand 3 more like it, not listed individually.
• db.js:26founda context-assembly function — this is where the allowlist belongs export async function buildContext(customerId) {

ARS-1.0-39 in the standard →