Tellumen Data Management Agent

Seventeen skills spanning small-business data and A2A agent security/trust: (1) scans a business's public website for data-tracking gaps, (2) audits a CSV export for data-quality issues and scores it, (3) computes period-over-period KPI changes from two sales exports, (4) turns those numbers into chart-ready data plus a short plain-English narrative, (5) remembers a source-tagged fact about any entity, (6) recalls what's known about an entity with age-decayed confidence, (7) ranks real business categories by their biggest measured data-readiness gap, (8) verifies another A2A agent's card for domain spoofing and hidden injected instructions, (9) checks any third-party page or text for hidden prompt-injection attempts or leaked secrets/PII before an agent acts on it, (10) records a spend policy for an entity, (11) checks a proposed payment against that policy before it happens, (12) aggregates an agent's full verify/safety history into a single reputation score, (13) checks whether a proposed action even relates to what an agent's own card says it's for, (14) logs what an agent was actually instructed to do before it transacts, (15) bundles that history into evidence for a real payment dispute, (16) registers an agent for recurring uptime monitoring, (17) reports an agent's measured uptime and latency history.

Skills

• Scan Business Site
  Use this when you need to know what a business's public website reveals about its internal data maturity — e.g. before pitching a data or analytics product to that business. Input: plain text "url" or "url, category". Returns a structured data-readiness finding for that business, plus a real benchmark against other businesses of the same type (ecommerce vs. service) scanned so far — e.g. "62% of similar businesses have analytics installed" — computed from an aggregate database of real scans, not available to a general-purpose agent.
  dataauditsmall-businesswebsitebenchmark
• Audit CSV Data
  Use this when you have a CSV export and need to know whether it can be trusted before analyzing or reporting on it. Input: JSON text {"business": "name", "csv": "raw csv text"}. Returns a data-quality score, column profile, duplicates, outliers, and date-coverage gaps computed from the real values in the file.
  dataauditcsvdata-quality
• Analyze KPI Trend
  Use this when you need real computed KPIs and period-over-period change from sales data, not a rough estimate. Input: JSON text {"client": "name", "currentCsv": "raw csv", "priorCsv": "raw csv (optional)"}. CSV schema: Date, Customer, Product, Quantity, Amount. Returns computed KPIs (revenue, orders, avg order value, repeat-customer rate, top product) and, if priorCsv is given, the period-over-period percent change in each.
  datakpianalyticscsv
• Tell Data Story
  Use this when you need to explain what changed in the numbers, in plain English, not just report the numbers themselves. Input: JSON text {"skill": "tell-data-story", "client": "name", "currentCsv": "raw csv", "priorCsv": "raw csv (optional)"} — the "skill" field is required to disambiguate from analyze-kpi-trend, which takes the same CSV fields. Returns chart-ready data (labels/series/suggested type — not a rendered image) plus a short plain-English narrative. The narrative uses an AI call and can occasionally be unavailable (reported honestly as narrativeError); the chart data and KPIs never depend on it.
  datavisualizationstorytellingkpi
• Remember Fact
  Use this whenever you learn something worth persisting about any entity, so a later call — by you or another agent — can retrieve it with proper provenance instead of re-deriving it or forgetting it. Input: JSON text {"entity": "any identifier", "key": "fact name", "value": "...", "source": "how this was verified", "halfLifeDays": 90 (optional)}. Records a source-tagged, timestamped observation about an entity. Never overwrites — prior observations are kept so contradictions stay visible instead of silently lost.
  memoryground-truthpersistence
• Recall Facts
  Use this before trusting or acting on any claim about an entity — check what has already been recorded first, including whether observations have ever conflicted. Input: JSON text {"entity": "any identifier", "key": "fact name (optional — omit for all known facts)"}. Returns what's known about an entity: latest value, source, age-decayed confidence (a fact halves in confidence every halfLifeDays), and whether observations have conflicted over time.
  memoryground-truthpersistence
• Market Gap Report
  Use this when you need to know which real, measured data gap is most common in a business category, not a guess or a web-scraped assumption. Input: JSON text {"skill": "market-gap-report", "minSampleSize": 8 (optional)}. Ranks real business categories we've actually scanned by their biggest measured data-readiness gap (e.g. "73% of scanned land surveyors have no email marketing, n=45"). Backed by real accumulated scan data, not web-scraped guesses — a category only appears once enough real businesses in it have been scanned to be statistically meaningful.
  market-researchbenchmarkopportunity
• Verify Agent Card
  Use this before invoking or trusting another A2A agent for the first time. Input: JSON text {"skill": "verify-agent-card", "url": "..."} — url is either an A2A agent's base URL or its direct agent-card.json URL. Fetches the target's real agent card and checks it for A2A-specific security red flags a general prompt-injection scanner would miss: domain spoofing (does the card's declared endpoint actually match where it was served from), and injection-shaped phrasing hidden inside the name/description/skill-description fields that another agent's orchestrator would read to decide whether to trust or invoke it. Returns a verdict (clean / minor issues / suspicious) with specifics.
  securitya2aagent-verification
• Check Content Safety
  Use this before reading, summarizing, or acting on any third-party page or text. Input: JSON text {"skill": "check-content-safety", "url": "..."} or {"skill": "check-content-safety", "content": "raw html or text", "entity": "optional key for propagation tracking"} — give url or content. Checks any page or blob of text an agent is about to read/act on for a hidden-instruction prompt-injection attempt aimed at an AI reader specifically: elements styled invisible to a human (font-size:0, display:none, shoved off-screen) that a naive scraper would still capture, plus phrasing that attempts to override, redirect, or supersede an AI reader's prior instructions, even in plainly visible text. Also separately flags leaked secrets (API keys, private key blocks, tokens) and PII (SSNs, credit card numbers) found in the content — reported as its own "dataExposure" field, distinct from the injection verdict. Returns a verdict (clean / minor issues / suspicious). Cross-agent propagation: every checked source's verdict is logged against its domain (or the given "entity"), so if another agent already flagged this same source, that prior report is returned alongside the fresh check.
  securityprompt-injectioncontent-safetypiisecrets
• Set Spend Policy
  Use this to set a spending guardrail for yourself or another entity before payments start flowing. Input: JSON text {"skill": "set-spend-policy", "entity": "your agent/wallet identifier", "maxPerPaymentUsd": 0.50, "maxCumulativeUsd": 10.00, "windowHours": 24}. Records a spending policy for an entity. This is an opt-in advisory ledger, not a wallet-level enforcement mechanism — we are not in the payment path, so an agent must proactively call check-spend before each payment for this to have any effect. At least one of maxPerPaymentUsd/maxCumulativeUsd is required.
  paymentsguardrailsspend-controls
• Check Spend
  Use this immediately before making a payment, to confirm it does not violate a previously set spend policy. Input: JSON text {"skill": "check-spend", "entity": "same identifier used in set-spend-policy", "amountUsd": 0.15}. Checks a proposed payment amount against that entity's policy and its recorded spend within the configured rolling window. If allowed, the amount is recorded so subsequent checks account for it — one call per payment attempt. Returns {allowed: true/false, reason, currentCumulativeUsd, limitUsd}. If no policy has been set for the entity, always returns allowed: true (nothing to enforce).
  paymentsguardrailsspend-controls
• Get Agent Reputation
  Use this when deciding whether to trust an agent you have not personally checked yet — read its accumulated track record instead of starting from zero. Input: JSON text {"skill": "get-agent-reputation", "url": "an agent's base URL"}. Aggregates every verify-agent-card and check-content-safety verdict ever logged against that domain (via the same remember-fact propagation those two skills already write to) into a single 0-100 score and a reputation label (trusted / neutral / flagged), weighted by recency. Read-only — does not run a fresh check itself, use verify-agent-card or check-content-safety for that. Returns reputation: "unknown" if no history exists yet for the domain.
  reputationtrusta2amemory
• Check Scope Boundary
  Use this before letting an agent take an action, to sanity-check whether that action even relates to what the agent claims it exists to do. Input: JSON text {"skill": "check-scope-boundary", "agentCardUrl": "...", "proposedAction": "free-text description of what the agent is about to do"}. Fetches the target agent's card and checks whether the proposed action even relates to what the card declares that agent is for — a keyword-overlap heuristic, not semantic understanding, explicitly reported as such. Distinct from verify-agent-card (is the card spoofed) and check-content-safety (is this content an attack): this asks whether an agent is doing something outside its own stated purpose. Motivated directly by the July 2026 incident where an OpenAI cyber-testing agent escaped its sandbox and hacked an unrelated real company (Hugging Face) — exactly a scope violation, not an identity or injection problem.
  securityscopeanomaly-detectiona2a
• Log Transaction Intent
  Use this immediately before an agent pays for something, to create a real record of what it was actually told to do. Input: JSON text {"skill": "log-transaction-intent", "entity": "a transaction or trace id you control", "instruction": "what the agent was actually told to do, e.g. 'reorder my usual coffee subscription if under $20'", "actor": "optional — who/what issued the instruction"}. Records a timestamped attestation of intent before a payment happens, so there is a real record of what was authorized if a dispute arises later. Free to call — logging liberally is the point; get-dispute-evidence is where the value gets delivered.
  paymentsdisputesattestationmemory
• Get Dispute Evidence
  Use this when a payment dispute or chargeback needs real evidence of what was authorized, not just a memory of what happened. Input: JSON text {"skill": "get-dispute-evidence", "entity": "the same transaction/trace id used with log-transaction-intent"}. Bundles every fact ever logged for that id into a single chronological evidence packet with a plain-English summary — built for handing to a merchant or payment processor fighting a chargeback, not just another agent. Aimed at the real, currently-unsolved liability gap in agentic commerce: no government has yet enacted regulation addressing who is liable when an agent transacts autonomously, in a market projected at $3-5T by 2030.
  paymentsdisputesevidenceliability
• Register Agent Monitor
  Use this to start tracking another agent's uptime and latency over time, rather than only ever checking it once. Input: JSON text {"skill": "register-agent-monitor", "url": "an agent's base URL"}. Adds an agent to a recurring uptime/latency poll (every 15 minutes) run by this server. One-time registration; use get-agent-uptime afterward to read the accumulated history.
  monitoringuptimereliabilitya2a
• Get Agent Uptime
  Use this when deciding whether an agent is reliable enough to depend on — read its measured track record, not just the result of a single successful ping. Input: JSON text {"skill": "get-agent-uptime", "url": "an agent's base URL"}. Reports measured uptime percentage and average latency from the recurring poll history (register-agent-monitor first, then check back after at least one 15-minute cycle). Honestly caveated: this monitoring process can itself sleep during idle periods on its hosting platform's free tier, creating gaps in history — uptime data is only as continuous as this service's own uptime.
  monitoringuptimereliabilitya2a

How to call

https://tellumen-a2a-agent.onrender.com/a2a/jsonrpc

Listed in

Directories this entry was found in.