Skip to content

For people running agents

Your agent says the job is done. Here’s the receipt.

TrustShell checks what an agent says it did against GitHub’s own record of the run. No account. One command.

Try InspectHow it works →

Developer preview. No account, no key.

A real receipt · abridged

A claim an agent might make:

“The check workflow succeeded on commit 5d1c5e3f57e1, run 39619591025.”

Claims: 3 supported · 1 contradicted · 1 not checked
✗ CONTRADICTED commit 5d1c5e3f57e1
  The claim cites commit 5d1c5e3f57e1; the inspected run is on 392797a69b6a.
✓ SUPPORTED The check workflow succeeded
✓ SUPPORTED run 39619591025
exit 1

The run was on a different commit than the claim named. The check read that from GitHub’s own record. Run it yourself.

What worries people, and why it is justified

  • “It says it did the thing. Did it?”

    A coding agent deleted a live database, and its owner says it then faked data and reported that tests had passed.[1]

    What TrustShell does. Inspect reads one public GitHub Actions run and marks each sentence your agent said Supported, Contradicted or Not checked, with the field that decided it.

    What it does not do. It covers GitHub Actions runs only. A Supported sentence is not permission to merge or deploy.

  • “My agent can spend money I never meant it to.”

    An AI-linked crypto wallet was talked into sending roughly $150,000 to $200,000 by a Morse-code message.[2]

    What TrustShell does. The SDK refuses to sign a payment that has no cap, goes over the cap, or comes from a turn that may not pay.

    What it does not do. It is a test-network feature, and the cap is set by the calling code, not signed by an owner.

  • “A skill I install, or an open port, hands my agent’s access to someone else.”

    Researchers reported 341 malicious skills on OpenClaw’s skill marketplace, and tens of thousands of internet-facing instances, many with authentication off.[3][4]

    What TrustShell does. It leaves a record you can read: what the agent claimed, beside what the run shows.

    What it does not do. It does not scan skills, lock down a gateway or sandbox anything. Isolate and audit those yourself.

See it. Limit it. Keep it.

  • See it

    Check what your AI says against the record, and see what each checker said.

  • Limit it

    A spending cap set in code, not in a prompt. Test network only.

  • Keep it

    Your memory and profile stay on your machine, whichever model you use. Moving them to another machine as one signed file is in preview.

Make yours in three questions.

Your rules, your memory. No wallet to start.

Build your agent

Sources

These are reports we read, not measurements we made. Where a number matters, read the original before you rely on it.

  1. [1] OECD AI Incident Monitor: a coding agent deletes a live database (July 2025). Reported from the owner’s posted chat logs and press coverage; not an independent audit.
  2. [2] OECD AI Incident Monitor: Grok / Bankr wallet drained by a Morse-code prompt (May 2026). The page values the loss at $150,000 to $200,000; headlines vary.
  3. [3] The Hacker News: OpenClaw and malicious skills on ClawHub (Feb 2026). Researchers reported 341 malicious skills. Secondary report.
  4. [4] DigitalOcean: OpenClaw security challenges (2026). Exposed instances and weak authentication. Counts differ between reports.