{
  "artifact": {
    "artifact_id": "sealkeeper-run-f028139b16",
    "artifact_name": "sealkeeper.run",
    "canonical_url": "https://sealkeeper.run",
    "artifact_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
    "first_seen_at": "2026-11-03T01:41:37.024Z",
    "last_changed_at": "2026-11-03T11:48:51.867Z",
    "change_count": 116,
    "receipt_count": 117,
    "versions": 117,
    "current_sha256": "d4a63b11c2bbb9ac1803d28f1d78a995ac4a13b1779d6edde0af3ba2ee028054",
    "version_note": "The bytes at this URL have changed across receipts: each distinct SHA-256 in the history is a distinct version of the artifact, recorded as its own receipt and never merged or overwritten.",
    "latest_receipt": {
      "id": "rsc_571dd43f218050d8bbe2128e",
      "artifact_id": "sealkeeper-run-f028139b16",
      "artifact_name": "sealkeeper.run",
      "canonical_url": "https://sealkeeper.run",
      "fetched_from": "https://sealkeeper.run",
      "sha256": "d4a63b11c2bbb9ac1803d28f1d78a995ac4a13b1779d6edde0af3ba2ee028054",
      "byte_size": 64074,
      "scanner_version": "resource-scan-v1",
      "scanned_at": "2026-11-03T11:48:51.867Z",
      "checks": [
        {
          "id": "network",
          "label": "Outbound network references",
          "status": "flag",
          "findings": [
            "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
          ],
          "evidence": [
            "domain: agents.privatedao.org",
            "domain: api.sealkeeper.run",
            "domain: challenges.cloudflare.com",
            "domain: github.com",
            "domain: sealkeeper.run"
          ]
        },
        {
          "id": "credentials",
          "label": "Credential and environment access",
          "status": "pass",
          "findings": [
            "No credential or environment access patterns were found in the scanned bytes."
          ],
          "evidence": []
        },
        {
          "id": "install_hooks",
          "label": "Install and postinstall hooks",
          "status": "pass",
          "findings": [
            "No install or postinstall hooks were found in the scanned bytes."
          ],
          "evidence": []
        },
        {
          "id": "obfuscation",
          "label": "Obfuscation and encoded payloads",
          "status": "pass",
          "findings": [
            "No obfuscation or encoded-payload signs were found in the scanned bytes."
          ],
          "evidence": []
        },
        {
          "id": "shell_and_download",
          "label": "Shell-outs and download-and-execute",
          "status": "pass",
          "findings": [
            "No shell-out or download-and-execute patterns were found in the scanned bytes."
          ],
          "evidence": []
        },
        {
          "id": "permission_vs_behavior",
          "label": "Permission declarations vs behavior",
          "status": "flag",
          "findings": [
            "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
          ],
          "evidence": [
            "behavior: network"
          ]
        },
        {
          "id": "known_bad",
          "label": "Known-bad indicators",
          "status": "pass",
          "findings": [
            "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
          ],
          "evidence": []
        },
        {
          "id": "provenance",
          "label": "Provenance facts (weak signals)",
          "status": "flag",
          "findings": [
            "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64074."
          ],
          "evidence": [
            "source host: sealkeeper.run",
            "bytes scanned: 64074"
          ]
        }
      ],
      "checks_total": 8,
      "checks_flagged": 3,
      "summary": "3 of 8 checks flagged",
      "ledger_seq": 6783,
      "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
      "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_571dd43f218050d8bbe2128e, verify at rightshold.com/verify."
    },
    "history": [
      {
        "id": "rsc_571dd43f218050d8bbe2128e",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "d4a63b11c2bbb9ac1803d28f1d78a995ac4a13b1779d6edde0af3ba2ee028054",
        "byte_size": 64074,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T11:48:51.867Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64074."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64074"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6783,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_571dd43f218050d8bbe2128e, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_5a94750fdf6c67a8c04ccb60",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "4ce439ef4bcb38f6a6b66ce60690a2cad3357807e3a8f2f9087190b7cdde8304",
        "byte_size": 64076,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T11:43:51.563Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64076."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64076"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6778,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_5a94750fdf6c67a8c04ccb60, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_62573b29291a953601f8854b",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "18a7bf0182270403760396326f19795ba302aff9356d2da3d17ff6150187f796",
        "byte_size": 64076,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T11:33:48.784Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64076."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64076"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6769,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_62573b29291a953601f8854b, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_13ef247fccdfe8a80e220e3f",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "eef0e3d6eb7d2ea7577aa28db08e2475f77d1cb1549bb9e0b6343df57e8f71ec",
        "byte_size": 64076,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T11:28:49.005Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64076."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64076"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6764,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_13ef247fccdfe8a80e220e3f, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_5b52ec8d906e8b3a361afaec",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "019a3ff6c67271c508848c34b7f6167f684145b58cb9d6ba8296a084f50e0b47",
        "byte_size": 64076,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T11:23:48.819Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64076."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64076"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6758,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_5b52ec8d906e8b3a361afaec, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_5a2f01a043c4d84dc1358f54",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "8faf151c83690500d27f2927996880afa9680fa7c814d7565a2e2e00e9be5be0",
        "byte_size": 64076,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T11:18:49.181Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64076."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64076"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6745,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_5a2f01a043c4d84dc1358f54, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_d1636030ca4d60993195ed6d",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "cfcc0e7dadb46607959f345bab7170f6c94af5fd3e5f46c70ce500e3279c11dd",
        "byte_size": 64076,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T11:13:48.741Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64076."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64076"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6739,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_d1636030ca4d60993195ed6d, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_030e9bdea26a64d8e425e5a6",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "59e84001ab5796c162705807f55b48689ae475cf19bb891451304232a9ff0ee5",
        "byte_size": 64076,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T11:08:50.221Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64076."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64076"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6734,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_030e9bdea26a64d8e425e5a6, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_7300bc5aca091c6152beba91",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "720d27ce9638dd8c1b0ac36ae5d73062e16c6a557de2b96a281c2c14355bfd8c",
        "byte_size": 64076,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T11:03:48.631Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64076."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64076"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6728,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_7300bc5aca091c6152beba91, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_60da9427b7ede7722bb6e830",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "57ca2d1d4cb2d3f696077b99b278c6df2a8b9bd9acf7b26f78d959663f04e5d4",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T10:57:38.687Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6720,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_60da9427b7ede7722bb6e830, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_bf9d929719508c2c71378c54",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "f29d5619569da20e8b4e185eb948f195b32eb94d736736f47da98f8ea0ceb736",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T10:52:38.510Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6715,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_bf9d929719508c2c71378c54, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_d1e39c500a46424ae7e04fd4",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "70eaf45f6cb71cce081e4e01e3245c16da81da1301ed4af359a33fc851c84d2d",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T10:47:38.654Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6709,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_d1e39c500a46424ae7e04fd4, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_1800b54050c1fa31643628c8",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "c2d5cc109d87afaf5e8b854fa986e3fc2ab4ef149eb9357b568eb457c783cc29",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T10:42:38.328Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6703,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_1800b54050c1fa31643628c8, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_57c20823082b3bf8777dd1a4",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "99eb3cf13d120aa763a531241053bceddcb0f971b453266e967f3ac1a015b61b",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T10:37:38.176Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6696,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_57c20823082b3bf8777dd1a4, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_4256b1096c745cd1399599bc",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "275038f01b5bb29b910519461a9db66842a8f37eb46a56da4e2c133f608b837c",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T10:32:38.311Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6690,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_4256b1096c745cd1399599bc, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_70bba562b143e02938595540",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "6e38dc0890916061f200eab31440c7a326540924df59b8e75c4c70d787c0cef4",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T10:27:38.095Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6684,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_70bba562b143e02938595540, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_9307654cbd944d7bfece4307",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "1147b72e071f28c22594792978ad0e0ab9c19a71b822ff37236652184bcad5db",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T10:22:38.469Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6679,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_9307654cbd944d7bfece4307, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_ee2c392f0b87a11dffde923d",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "cdefd4d3881b347eec1e40a2c9573f4246a5bd8c449822296b19028b17994109",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T10:17:38.193Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6674,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_ee2c392f0b87a11dffde923d, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_32eac45a97bbdb9688f04750",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "e77ca475a8568277832cef7640eac73367087c1a814bb2ed3f1aa872efb3282e",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T10:12:38.141Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6667,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_32eac45a97bbdb9688f04750, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_e9cc43999492810fce63a891",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "06fa3b786ffdfb2d51122dd108821384bf9b97f199af339d1d3bd50ae77594ac",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T10:07:38.309Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6661,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_e9cc43999492810fce63a891, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_8154c402bee44bf83b22edad",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "82241af93ca8d1c9bbd820cb5001edceb302fcac100ea0b29e94a5683fa426ba",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T10:02:38.817Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6656,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_8154c402bee44bf83b22edad, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_ae076e98ff6c00030292fa40",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "06caaeb66c7487bdcc72a0e38d5883bb0836506a2f391b9fddf6fced07730999",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T09:57:38.557Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6651,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_ae076e98ff6c00030292fa40, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_60175aa31dd2497011873b15",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "2ced85863e2a33b39266d467d41077644fa81792e46b9541555516ee70c97468",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T09:52:38.065Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6636,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_60175aa31dd2497011873b15, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_94ebb296fc1d44969a87927a",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "d7e4ef27be291c28e9cb1d877188fac34a93ea6988f7f144305c2e85a53e2c79",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T09:47:38.198Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6631,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_94ebb296fc1d44969a87927a, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_c2d9cb94a40245b2681d42ca",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "44317175de1c4f7f2487660bc2fb719379f4a10069e8a674cc063edcfc1bbbe8",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T09:39:04.700Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6568,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_c2d9cb94a40245b2681d42ca, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_a092a2a89ea49596b5b3699e",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "17c5f323c65cb060afe9865def5f1feb37d575d0dc42d83a89e90aec5604fdad",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T09:34:04.532Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6561,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_a092a2a89ea49596b5b3699e, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_096ec2e690395b293e7ce0be",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "f621f555c3924361f06b88942dc4e277860497f3151fa04bd4971a651acb2b94",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T09:29:04.793Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6556,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_096ec2e690395b293e7ce0be, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_306b728b902ba6fb690d2cc1",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "f3b30963cb1aaeb6f3ccff4d8781475bad372783b8f9e24def6b79d3a7c01ad3",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T09:24:04.783Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6551,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_306b728b902ba6fb690d2cc1, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_e1ebbefedc7c358d5926d7e9",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "4e88920aad9dd058d6ca1b935b1c59c04cb163bcaff253bb9ac5943dcf3d9f8e",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T09:19:04.982Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6546,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_e1ebbefedc7c358d5926d7e9, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_69b4d4572f5a59838312eeb9",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "e4f919fe3a283cc05ebbb0f0c87acb640c200b1047357eae1fc7b5c9bf9d1eb2",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T09:14:04.577Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6539,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_69b4d4572f5a59838312eeb9, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_2734ea96a826e16893d2a0cb",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "4f9cf0b364d6d2208573525bbdbd03931b945b8ab1cb1b0eb48d70d09431469c",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T09:09:04.930Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6534,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_2734ea96a826e16893d2a0cb, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_fe68777e94dfbaff2ea184e8",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "83838879c08121403dea74cad53ebcd699057de78b0717c0c075464176443cf0",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T09:04:04.547Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6529,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_fe68777e94dfbaff2ea184e8, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_eba5935a5acd8b75e538aa59",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "61826333dffa2971f65749249b78f79bd2a22ffd9786b5abce0a008c576408bc",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T08:59:04.668Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6524,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_eba5935a5acd8b75e538aa59, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_cf6a00f1ea9c9c0a77b33e65",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "ad14c92143928c2439382c4a2094da1ac184fad5ed68b7f4d3e37bbdadefca41",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T08:54:04.499Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6517,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_cf6a00f1ea9c9c0a77b33e65, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_59e1f8609df490d92bb711e4",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "2ecec47a062a127a3a3191cfa05d693195cb0cc62b645061d75e815fe748c558",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T08:49:04.702Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6512,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_59e1f8609df490d92bb711e4, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_58620471f50fc913f82eba79",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "e64b3ab9c0753e60aa318e41882f97f3c04de12d105c6ad1ac953b0da3ff18e0",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T08:44:04.350Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6507,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_58620471f50fc913f82eba79, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_9ec6ee0ba985112d0b91c9e1",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "1a981ebd9005002c02274722d456f9238326972a5b665cb96cb5b048779cb652",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T08:39:04.409Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6499,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_9ec6ee0ba985112d0b91c9e1, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_d1393af2da5776a5e3abe9fe",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "a7e7582a77c32a80af09c55218b6c11000c999cc82ab01d6d6bbfaea63281295",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T08:34:04.567Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6494,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_d1393af2da5776a5e3abe9fe, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_9c67ee6e95921d70776adb86",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "55d718136cbc9476373b4a8b101180b407ef09ade459578b9e519984be9e5fa7",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T08:29:04.185Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6489,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_9c67ee6e95921d70776adb86, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_f4fcebd1fd1cb0cb28cb23d0",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "2814cb729420874efe89d0f668f5700b710e37649bdc7fd162e4617188b8bbdd",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T08:24:04.302Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6484,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_f4fcebd1fd1cb0cb28cb23d0, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_93a4f7f165e49ba2082927a0",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "3fed7dea58ad6328d9bb3d09283274be27adafd57cd089fbeca54e3c5183a3d6",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T08:19:04.540Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6477,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_93a4f7f165e49ba2082927a0, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_c9ac400ab092414eccdb1561",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "3c2511bdb6ad5f67ba5c0743b5c15a3b118632ec29d81d8b55ab38e3bb537691",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T08:14:04.497Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6472,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_c9ac400ab092414eccdb1561, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_406ff5976f8fbe8b7e3ba7e1",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "06d7bd8617263bb180f86e247cdcb63392c71c1b75945e5baca72eca6a5e94c6",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T08:09:04.187Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6467,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_406ff5976f8fbe8b7e3ba7e1, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_39742fcd299795dd8dff8956",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "f2da82c1924c5c8099b02994304311827c23f99d76e378214c55f8f55b031c26",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T08:04:04.404Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6462,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_39742fcd299795dd8dff8956, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_82f45645344cf5a03e3b26bf",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "b1c266ec4358ffce06a52a5f610bf1822a8a21c085dc0b2241740a459929f4da",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T07:59:04.164Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6455,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_82f45645344cf5a03e3b26bf, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_c243be976996a3211c18458c",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "2bae6fcaadbe3a32c02b311da4029d4087113f808d5f6addcc2f9f5ccd44a279",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T07:54:05.226Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6450,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_c243be976996a3211c18458c, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_5afa2a145f08d8e26fed62c0",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "af590b9c157da075d7f4ddd5a0cae5dfe5754084681fad151481857a0e24c178",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T07:49:04.108Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6445,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_5afa2a145f08d8e26fed62c0, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_70b4e12588645b1cf8b83572",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "fcbb7095fe06055e9e123b7a0166060961b2aaf63a71d4bab91de5a2826802ab",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T07:44:03.016Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6438,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_70b4e12588645b1cf8b83572, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_18913efcafe27773b1e1b20a",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "74d9b78f38c08b7b1aadac6e2a05f4ef45e6184feaac3e0a68b317283b175a79",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T07:39:03.254Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6433,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_18913efcafe27773b1e1b20a, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_3f5ed399d3ee9b80e62750c9",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "3c55a91c4a653a9e3fd26d4c9ca758af8e7a474e158855092db6e86841611a50",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T07:34:03.125Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6428,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_3f5ed399d3ee9b80e62750c9, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_d4821be7b284c3d0e732da67",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "0757048b7482afa03e9f9c1f73a7a33449575d9c1ef40f8801e222e6c1becbf1",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T07:29:03.114Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6420,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_d4821be7b284c3d0e732da67, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_37c7f64a363d0af75ef362cc",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "c294b86032bd2057d23158fe110ecccc73f51584893c481d73c13cd841d9cda2",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T07:24:02.997Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6413,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_37c7f64a363d0af75ef362cc, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_6aefc3baf871effc257daadd",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "221737cfec4cf4abd24822cd1fee4a15eecd38d5e202d0fd12eea3b324854091",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T07:19:03.222Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6408,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_6aefc3baf871effc257daadd, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_eb3d4fe4fb9049b4e94a9fce",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "1fb45a8fd57c6e5684fcebdfb02ad09c3555462a36167117f43e5c657423dcc4",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T07:14:02.901Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6403,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_eb3d4fe4fb9049b4e94a9fce, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_2f2f8a6850022413f4611c17",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "15815e6c8d1744ec3ca4f61d9cf74bde389335b3b5a23ee63321f9759fd01435",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T07:09:02.987Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6398,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_2f2f8a6850022413f4611c17, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_fc8ef8e363e6080ba5f5d9b5",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "ad9ff3b2c572a6a32806e42b047bbc8df99d733fd131da6444afb0461d3f1264",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T07:04:02.947Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6391,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_fc8ef8e363e6080ba5f5d9b5, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_aeaddacc2f2628b9e738f4a5",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "fd67623a3558a9830866beef69af2a1bc67bf66e1f730f850290fdcb04b3793f",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T06:59:02.957Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6386,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_aeaddacc2f2628b9e738f4a5, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_f88c26209acb8562d7c78c41",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "7abb10f92fa0a02562caaef3652eaa620f81ecebb9b58c2bcf34da69cec3838a",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T06:54:02.945Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6381,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_f88c26209acb8562d7c78c41, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_b8ba4d56a88f8ff60a59afcc",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "d0830d46288641bb82cd251ce4c292677e0451415c68b0103db746a6c3b149b3",
        "byte_size": 64069,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T06:49:03.100Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64069."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64069"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6376,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_b8ba4d56a88f8ff60a59afcc, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_50f039927882edc250414276",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "baf9bc89b2e71f9648ace0004fa4ecc15eb83995be92b8574ae6ba40f8e4b1b9",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T06:43:33.034Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6367,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_50f039927882edc250414276, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_743ca9cef37a560b2a3374fc",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "804537ef3a39ea48955a2c0e9c1c9c179b703340c1e9c58a320b427e11a72a61",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T06:38:32.813Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6362,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_743ca9cef37a560b2a3374fc, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_7a48429cc5376348498fef41",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "32fa111888b4cb384cf70b3f265a204aafc555acff2b1643684c82f0f9e9c805",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T06:33:32.775Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6357,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_7a48429cc5376348498fef41, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_d1c9c180d0e9295a8b674733",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "7cfdf950a120c13d17cf5c48e835a8d7913aa8410c25a8096b9f28e60ee32a17",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T06:28:32.749Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6350,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_d1c9c180d0e9295a8b674733, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_4f428ee86be0537ef7177fc7",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "7205bc5a84e8caeda226924e4056e87656b7b4eefe346bd16e33de3c971fc426",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T06:23:32.890Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6345,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_4f428ee86be0537ef7177fc7, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_cf01ef772ada909e894410f0",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "09020233fc67c2e4afc2d0d20d631371a310c85831dae176e3b2da12a1fd3d8d",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T06:18:32.732Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6340,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_cf01ef772ada909e894410f0, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_e926da329727d4c65373cc0e",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "15a514628b9ac93bbbc067680c120540e3606ce7902313da4adbe679d3a9a41f",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T06:13:32.684Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6335,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_e926da329727d4c65373cc0e, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_2e046249525b70db068a4434",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "887cf229d6f0424205062ca9d22a894ab07bc726244e5644d73b6b2e2f040aee",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T06:08:33.828Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6328,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_2e046249525b70db068a4434, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_c4cb6af472281c708deb7e44",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "d6d8971bd2eedf847b84db2a96056a999757f8f1f3d2b597b17b1f83bede0548",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T06:03:31.603Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6323,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_c4cb6af472281c708deb7e44, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_bc684f26ea338b4eb683034d",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "a986de9a03fbed8a5817baf1c169a20504bcf2f885912f4c8863600a152e7543",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T05:58:31.505Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6318,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_bc684f26ea338b4eb683034d, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_1120c92e377f8c53f2e8f730",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "c5dafb88704806c011f2614da8ab4f85aa0b0ccc3fa6e57fe2002b955615538b",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T05:53:31.279Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6311,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_1120c92e377f8c53f2e8f730, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_accc8cb00e26c5d1fb772a37",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "92f2af40251d6f511be87fa94c3790178a1c0111aa5d95847fce87ef60649a10",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T05:48:31.240Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6306,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_accc8cb00e26c5d1fb772a37, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_1eca51ec78efa09890c2942b",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "89837cd7fdf00e46d5337bbd8904b50c73793194ceb1914ec2c06899ce6fcea5",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T05:43:31.120Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6301,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_1eca51ec78efa09890c2942b, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_21857de3e75642af90a63ae0",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "79256c039fe1f4778f08354583536ef885f42ca3f94f22eb6d6b6111e0bda2bc",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T05:33:45.011Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6292,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_21857de3e75642af90a63ae0, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_bf0a032cbca893e790f69f51",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "64d7b788cab3b10424a2b430f4682321a8570ed1bc5bf70171d4beee6dda3ed6",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T05:28:44.996Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6287,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_bf0a032cbca893e790f69f51, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_a029fe98d2274e7409fb3d9b",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "a3e9570b7cae45364aa0921b1e9c16451142d56861e439c68d6b0bfc27d6de87",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T05:23:45.019Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6282,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_a029fe98d2274e7409fb3d9b, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_44fcb5cf931727a561ad48d6",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "3e0b882c8a21ae11f4d4cabe4b5285b2761810e18714762343161b091d18736c",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T05:18:44.962Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6275,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_44fcb5cf931727a561ad48d6, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_4a275d589d6391dc5b3563bb",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "f5fcca126f70cfba4d738787106baffa2282e145c93721b1a950b489f99d24f6",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T05:13:44.960Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6270,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_4a275d589d6391dc5b3563bb, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_2b50735bd7101199996807cc",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "b81b70ed1f0216fd8cf0ee869c5477be782cb61f6595d47ac2cb69c0f5798a99",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T05:05:56.083Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6261,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_2b50735bd7101199996807cc, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_166944e5afb866fd82138003",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "4f2aa977582555eae9813d466a7041aaebea7888a369e259af8481a3558cd721",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T05:00:56.122Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6254,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_166944e5afb866fd82138003, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_03b51c45baee19de30118f65",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "862fbb3eab07e50232ab20d39420f73a8d2706de03ebd115d6e0e601f437c1a2",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T04:55:56.083Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6249,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_03b51c45baee19de30118f65, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_eedc7e70b9af21feac9b174e",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "2fd4bde7349a6943e922662aa2464749bf10848a4193e12e0cf0b73040783535",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T04:50:56.095Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6244,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_eedc7e70b9af21feac9b174e, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_c5f490167b23f9e65d70f421",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "45301a7eff3e8a2a6a87ec0d152dc59e31d6240407ccc51754e1f5af3c95c961",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T04:45:56.105Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6239,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_c5f490167b23f9e65d70f421, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_68855c95707fc6b77ccaaf73",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "da4d01f8552e7b10e66a31327cdb9b85b16f7a7e838b190419f1d5604c7050ad",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T04:40:19.928Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6229,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_68855c95707fc6b77ccaaf73, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_603d1621f8298684ad967ba2",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "b13694bb907ff4735e43a08dc34549f75a09113451d1ee76e8fc1caf150383e8",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T04:35:20.208Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6224,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_603d1621f8298684ad967ba2, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_382f338f7943ae83e028f51a",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "9aaae249deaf886aed2537e15774fb4689750cee8697a67ec35a5eb1b70142a0",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T04:30:19.969Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6219,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_382f338f7943ae83e028f51a, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_02d43be100c4650cbcfa76b6",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "25d85b3b398fcbc23cb4f8373a10818b195a303f14ec1223a4e32d0bcb9a1e36",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T04:25:20.032Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6213,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_02d43be100c4650cbcfa76b6, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_72d6a47a67dc0e068749cbe8",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "c0205a9e70f485719b7ead6786087b6d91184b81fa3afeaebdc61801c6b35206",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T04:20:19.894Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6207,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_72d6a47a67dc0e068749cbe8, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_28836d330d92d48440cb64f3",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "23a6402920d8059649ac32ab4e794f2ebc0244d68dcca7295ec8af690949078c",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T04:15:19.994Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6202,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_28836d330d92d48440cb64f3, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_117fc2e494ade86c7a670f3d",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "a6ae28cb2f69beab3ff4fc6937c6b97a2d9b42e3e23b901196d65be523f9c578",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T04:10:19.885Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6197,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_117fc2e494ade86c7a670f3d, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_ff31e879a75ead6fa8ccf1e2",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "c89648fd2ce0f62112c27df8fdef6cc60188cd20bc8616bdb047533258ab4d78",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T04:05:19.859Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6191,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_ff31e879a75ead6fa8ccf1e2, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_70bfbf491be646a234edc732",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "f1bc4791fcb61577661a3a3233d4d03c4c02b2ecbe79c042d6ea3e64b8658dd3",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T04:00:19.980Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6185,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_70bfbf491be646a234edc732, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_954092d7b16dc11c19c6b237",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "c21128cb1f3211f560a1ca338f714d7efbabfb7a44950275c82703c8e9381b3d",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T03:55:19.316Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6180,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_954092d7b16dc11c19c6b237, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_af6c5c1bf939f6d60234bd2a",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "3864d2032f7abfe5b793b408f24c1f04715180dd6bf4a2bc6df731b3fa4fed43",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T03:50:19.291Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6174,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_af6c5c1bf939f6d60234bd2a, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_408ddfc3eaac44e4819af20e",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "5a9d0a6382f075a99ce738dd4af4f0f6d98afee9d6e224b0ba9ea478d6245824",
        "byte_size": 64071,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T03:45:20.343Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64071."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64071"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6168,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_408ddfc3eaac44e4819af20e, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_d0f01c3f7a9ea019478fc289",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "9b7f2bd07aa563fa02a95e6e498e4dce3d2a9172db8b1daa27cf8ae49d00ce81",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T03:40:20.393Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6163,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_d0f01c3f7a9ea019478fc289, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_36c42cc390c1ebe6ee423e2f",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "6ee862d434f39987ea19e08ad29b0ad120db19b384e3a2ffff68c0a81db18579",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T03:35:20.574Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6158,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_36c42cc390c1ebe6ee423e2f, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_437ca76e2dee7473df0c0261",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "cf323998273e64896e7e656096abe8a37552830b1049832fff40034072689aeb",
        "byte_size": 64073,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T03:30:20.342Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64073."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64073"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6152,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_437ca76e2dee7473df0c0261, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_3e564f670ced2b8faec7591f",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "e99fcbc2a0f24b8afcbeaf562718233e0c7591e7c4761ffe3166152c96faa242",
        "byte_size": 64103,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T03:25:20.312Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64103."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64103"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6146,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_3e564f670ced2b8faec7591f, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_ce00162ea279647e46847d02",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "7cf706f02a1b7e5f710a07ca70bef635cacd340645bda8b8af38f01d5c47999e",
        "byte_size": 64103,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T03:20:18.535Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64103."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64103"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6141,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_ce00162ea279647e46847d02, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_8c83f926706f936b7eb88086",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "56016d1f60fb8b236af5055f9c93e33c74cb9bab5f40c2e117732163eda23806",
        "byte_size": 64103,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T03:15:17.731Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64103."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64103"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6135,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_8c83f926706f936b7eb88086, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_3ffad86458e2acd8e9ed436c",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "2df7d14fc937cca7a1a9874fc28bf0f9ddde87aa93b8900aee03fc40b830838d",
        "byte_size": 64103,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T03:06:06.817Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64103."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64103"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6126,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_3ffad86458e2acd8e9ed436c, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_f465047c3a7b15f00fe170b1",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "d18e682fe34b19c0c17addb6c3f53e8401b21f511b7ed0b4b08262c84decb108",
        "byte_size": 64103,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T03:01:06.891Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64103."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64103"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6121,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_f465047c3a7b15f00fe170b1, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_7c1812fa8e61c60a9366431d",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "2d05ae725980050e37d557b0946674a0d3f5c0c864eb4e24706e7d12d153450a",
        "byte_size": 64103,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T02:56:06.745Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64103."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64103"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6115,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_7c1812fa8e61c60a9366431d, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_c20f557596d4097aed676a16",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "f750e291b7489282370e880bec258ac61d6b73345181aa986289958416bf92df",
        "byte_size": 64103,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T02:51:06.377Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64103."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64103"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6109,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_c20f557596d4097aed676a16, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_8fe92d6183e15bafca933fcf",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "eea34eab0b6121f973012255bb58bd92233dcbba534e96a53808c44f2386d31a",
        "byte_size": 64101,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T02:46:06.344Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64101."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64101"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6101,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_8fe92d6183e15bafca933fcf, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_e4c01fb1ea790bae77c0bcfe",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "aa45499510b6a0d4f5cbb4038a177259bb3c5d5cb7c829033d4728cec7e08b7e",
        "byte_size": 64103,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T02:41:06.589Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64103."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64103"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6095,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_e4c01fb1ea790bae77c0bcfe, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_ee71460b05e3edc16c0d3153",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "c3754cbe7ed32ab36d1df363dfe0bff3cc6c9c2d84da55c9ec94dc3bc8696e4c",
        "byte_size": 64103,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T02:36:07.722Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64103."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64103"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6090,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_ee71460b05e3edc16c0d3153, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_778f9990cf9671f21a5d5639",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "726fe7ef3a3981560531a41163b7832384b19544708ece37ac54ad315ac17e21",
        "byte_size": 64101,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T02:31:07.484Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64101."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64101"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6084,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_778f9990cf9671f21a5d5639, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_05628c876926bdb04172f30c",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "73138000b161bcbef0464ea9c79dc818df10240c818a0c536c70e39bc7c94cef",
        "byte_size": 64103,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T02:26:07.066Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64103."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64103"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6079,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_05628c876926bdb04172f30c, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_9ded0b6824b9c80bb4f2a933",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "54a5de7a6243794d1855dfeecdd32e1c07086e2081b668747bd813fd596548b7",
        "byte_size": 64101,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T02:21:04.874Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64101."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64101"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6073,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_9ded0b6824b9c80bb4f2a933, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_bbb198b883ab4fafa65f862a",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "837a3bf350af66767146c0bc9ab9e905375c3265f4ee8696a8cb22c70a7184a7",
        "byte_size": 64101,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T02:16:04.913Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64101."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64101"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6067,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_bbb198b883ab4fafa65f862a, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_1561cc9d4eabdb1554d05a5c",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "d86cf2c97723408dcccbfe80df134ce644233d2b120ff355577d857355879094",
        "byte_size": 64099,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T02:11:04.828Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64099."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64099"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6062,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_1561cc9d4eabdb1554d05a5c, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_6d146ae48c2caa7aca1ccf43",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "8d35e6a42796b4ba3032171b272037c04eb81f6291189f414b15bdbe050799ca",
        "byte_size": 64103,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T02:06:04.877Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64103."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64103"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6057,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_6d146ae48c2caa7aca1ccf43, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_f3c118fed00b45c84e97d607",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "84664fe35c6d94d09efdd1033968c19f8a59aa102ed8ad44126eb92b928bec39",
        "byte_size": 64103,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T02:01:06.667Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64103."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64103"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6050,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_f3c118fed00b45c84e97d607, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_96057f8095ca150af51394a2",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "368e13f8ffb07eb17bde837068a4c32cb301b6dfe64bd317d7f5d50c3296a075",
        "byte_size": 64099,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T01:51:15.870Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64099."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64099"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6043,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_96057f8095ca150af51394a2, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_a0aef5ee846a009fbc3859d1",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "40daf724a042d7b4f4405cf9148b720aee46aa862deba4b9c0770b481df968f3",
        "byte_size": 64096,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T01:46:14.837Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64096."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64096"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6038,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_a0aef5ee846a009fbc3859d1, verify at rightshold.com/verify."
      },
      {
        "id": "rsc_6b9da0a4dc53483d3c2c73c4",
        "artifact_id": "sealkeeper-run-f028139b16",
        "artifact_name": "sealkeeper.run",
        "canonical_url": "https://sealkeeper.run",
        "fetched_from": "https://sealkeeper.run",
        "sha256": "a3123c760f6be1272ccf34c5ea9110a00e74f1e7b03fdbafa603a805e36b5e0e",
        "byte_size": 64094,
        "scanner_version": "resource-scan-v1",
        "scanned_at": "2026-11-03T01:41:37.024Z",
        "checks": [
          {
            "id": "network",
            "label": "Outbound network references",
            "status": "flag",
            "findings": [
              "The scanned bytes reference outbound network activity to these domains: agents.privatedao.org, api.sealkeeper.run, challenges.cloudflare.com, github.com, sealkeeper.run. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose."
            ],
            "evidence": [
              "domain: agents.privatedao.org",
              "domain: api.sealkeeper.run",
              "domain: challenges.cloudflare.com",
              "domain: github.com",
              "domain: sealkeeper.run"
            ]
          },
          {
            "id": "credentials",
            "label": "Credential and environment access",
            "status": "pass",
            "findings": [
              "No credential or environment access patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "install_hooks",
            "label": "Install and postinstall hooks",
            "status": "pass",
            "findings": [
              "No install or postinstall hooks were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "obfuscation",
            "label": "Obfuscation and encoded payloads",
            "status": "pass",
            "findings": [
              "No obfuscation or encoded-payload signs were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "shell_and_download",
            "label": "Shell-outs and download-and-execute",
            "status": "pass",
            "findings": [
              "No shell-out or download-and-execute patterns were found in the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "permission_vs_behavior",
            "label": "Permission declarations vs behavior",
            "status": "flag",
            "findings": [
              "The bytes show network behavior, and no permissions declaration was found in the scanned bytes to compare it against."
            ],
            "evidence": [
              "behavior: network"
            ]
          },
          {
            "id": "known_bad",
            "label": "Known-bad indicators",
            "status": "pass",
            "findings": [
              "None of the scanner's published known-bad indicator patterns matched the scanned bytes."
            ],
            "evidence": []
          },
          {
            "id": "provenance",
            "label": "Provenance facts (weak signals)",
            "status": "flag",
            "findings": [
              "Only partial provenance facts could be read from the URL — a weak signal, recorded as such: source host: sealkeeper.run; bytes scanned: 64094."
            ],
            "evidence": [
              "source host: sealkeeper.run",
              "bytes scanned: 64094"
            ]
          }
        ],
        "checks_total": 8,
        "checks_flagged": 3,
        "summary": "3 of 8 checks flagged",
        "ledger_seq": 6033,
        "receipt_url": "https://www.rightshold.com/resource-scans/sealkeeper-run-f028139b16",
        "rightshold": "The rightshold on https://sealkeeper.run — scanned 2026-11-03 · 3 of 8 checks flagged · receipt rsc_6b9da0a4dc53483d3c2c73c4, verify at rightshold.com/verify."
      }
    ]
  }
}