Security
Every push is checked against the OWASP Top 10 for Agentic Applications: what the agent read, pulled in, ran and wrote. The pre-filter runs on arrival; IBM Bob reads the evidence and writes one verdict per push. A finding is medium or worse on an agent run, and an identity finding needs a credential, key or secret file in the record; everything else is kept as a note on the commit page. Evidence, never a gate decision.
1
pushes checked
4/4
agent runs reviewed by Bob
0
need attention
10/10
checks with no finding
The ten checks
Hidden or injected instructions · ASI01
no finding1 note
Tool use beyond the task · ASI02
no finding2 notes
Secrets and credentials · ASI03
no finding3 notes
Dependencies and supply chain · ASI04
no finding2 notes
Code and commands the agent executed or generated · ASI05
no finding2 notes
Changes to the agent's own instructions · ASI06
no finding1 note
Agent-to-agent traffic · ASI07
no finding1 note
Spread to later work · ASI08
no finding1 note
Misleading the approver · ASI09
no finding2 notes
Acting outside its mandate · ASI10
no finding1 note
Latest pushes full evidence on the Pushes tab
-
This push vendors a third-party payment-utilities package (19a66de), scaffolds a payments API (1aa772b), installs Origit agent tooling (6d3d981), and includes two agent runs (#43, #42) that read sourc… details
