Audit inconclusivecurated example, not installable

RPC Proxy (example, audit inconclusive)

MCP server · v0.5.0 · published by Fugugent example author · free

Installing this gives the agent tools the agent can call, described in text the agent trusts.

Curated examples. The registry answered, and it holds nothing that matches.

These records are curated EXAMPLES shipped with the backend to exercise every audit status. They are not real skills, authors, or auditors, and nothing here is installable. Every example carries example: true and an id prefixed with 'example-'. Every record below carries an example tag and an id beginning example-. Nothing here is installable, and no author or auditor named below is a real one.

Who the auditors are

How it got here

1the skill registry, answered, but empty, 0 itemsskill example-rpc-proxy is not in the registry
2bundled examples, answered, 1 itemThese records are curated EXAMPLES shipped with the backend to exercise every audit status. They are not real skills, authors, or auditors, and nothing here is installable. Every example carries example: true and an id prefixed with 'example-'.

Audit inconclusive

Not known. An audit ran and could not decide, or its evidence is not held. Nothing was cleared and nothing was ruled out.

audit example-audit-rpc-1 ran against this build and could not reach a verdict: the shipped artefact is a stripped binary the sandbox could not instrument, so its actual behaviour was never observed

Same bytes, both sides

audited: 633d56858dfb8e6db2fb…
serving: 633d56858dfb8e6db2fb…

Audits on record: 1 · the full history is below, in whatever state each one is in
Verdict completed: 2026-09-06
Auditor: example-auditor-reef
Evidence held: on record, but not openable from here: the .invalid domain is reserved by RFC 2606 and never resolves, this is an example, and there is nothing behind it

What the author claims

Quoted word for word, and treated as untrusted. On a poisoned add-on this text is the attack: it reads as documentation to a person and as an instruction to an agent.

Proxies JSON-RPC calls to a configured node. The audit ran but could not observe the binary's behaviour, so it reached no verdict — which is reported as INCONCLUSIVE rather than rounded to either safe or dangerous.

claims: forwards JSON-RPC requests

Builds

A verdict is bound to the exact bytes it examined. When a new version is published, the old verdict does not move with it. That is the whole defence against a clean first version followed by a poisoned second one.

v0.5.0633d56858dfb8e6d…2026-09-06examined by example-audit-rpc-1served now

Audit history: 1 on record

automated audit of v0.5.0

example-audit-rpc-1

State: complete · verdict inconclusive · risk medium
Auditor: example-auditor-reef
Build examined: 633d56858dfb…
Dates: requested 2026-09-06 · completed 2026-09-06
Fee: $1.00 paid to the auditor when the verdict stands
Bond: $2,500.00 lost by the auditor if the verdict is overturned

the shipped artefact is a stripped binary the sandbox could not instrument, so its actual behaviour was never observed

Scope: description-injection · network egress · wallet. Anything outside it was not examined.

Pipeline

scanner · passedno hidden directives in the manifest
sandbox · inconclusivebinary could not be instrumented; behaviour unobserved
fork · inconclusiveno transactions were produced, but none could be ruled out either
synthesizer · inconclusiveinsufficient evidence to conclude either way

Findings

mediumbehaviour could not be observed
The sandbox could not instrument the shipped binary. Nothing malicious was seen, and nothing was ruled out — this is reported as inconclusive, not as clean.

Evidence

The report is not openable from here: the .invalid domain is reserved by RFC 2606 and never resolves, this is an example, and there is nothing behind it.its digest is on record: sha256 cc793ac4d473ef413716893e…

Escrow

This job is not on chain: the backend reports NOT_WIRED, with no job id and no transactions. The escrow contract itself is deployed and verified, 0x0354d2a4…ec8a52 ↗, and its fee, money at stake and release cycle has been run end to end. Those transactions are at the foot of this page. What has not happened is this audit being settled through it.

Identity

Registry id: example-rpc-proxy
Source: https://example.invalid/skills/rpc-proxy: the .invalid domain is reserved by RFC 2606 and never resolves, this is an example, and there is nothing behind it
Author address: 0x00000000…00dEaD ↗
Listed: 2026-09-06 09:00 UTC

Digest of the build being served

633d56858dfb8e6db2fbb98743c9fa69912427e4a43169d514580f3dad7a30fe

What makes a verdict cost something

The fee and the money at stake live in FuguAuditEscrow on the BNB Chain test network, deployed and verified. The cycle below has been run on it end to end: job created, fee funded, money put at stake, settled. The mechanism behind every verdict on this page is a contract anybody can read, not a promise.