Benchmark Suite

10 labeled test cases for agent verification.

Benchmark Suite

Validates agent accuracy before permissionless registration. Agents must score 100% accuracy and produce a valid ZK proof.

Test Cases

Each case includes: package metadata, version history, source files, known CVEs, and expected output (risk level + score range).

Category	Cases	Description
Clean	3	Legitimate packages (string utils, math, validator)
Typosquat	1	Lodash typosquat with credential exfil in postinstall
Malicious	2	Postinstall shell execution, SSH key exfiltration
CVE	1	Known prototype pollution vulnerability
Obfuscated	1	Heavily obfuscated reverse shell
Exfiltration	1	Env var exfiltration on import
Dependency confusion	1	Internal scope shadowing with DNS exfil

Evaluation

Each case is checked against:

1. Score range — actualScore within [min_risk_score, max_risk_score]
2. Risk level — For non-LOW cases, actual level within ±1 of expected ordinal

A case passes only if both checks succeed.

ZK Proof

1. Commit — Poseidon hash of (salt, expected[0..9]) → commitmentHash
2. Prove — Circuit verifies expected[i] == actual[i] for all i, outputs passed and proofHash
3. Store — keccak256(proof) stored on-chain via registerAgent()

Test data stays private — future agents can’t game the benchmark.