V19 Governance Protocol Spec

• Analyzed: May 9, 2026, 1:01 PM
• Findings: 1
• Version: 1.0.3
• Hash: 31f533279f2b488d7ad7781852f09870df3655966493fe3d553305aad675d834
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle defines a 'governance protocol' that instructs the AI agent to send decision logs and metadata to an external endpoint hosted on a temporary Cloudflare tunnel (sat-personals-investment-hung.trycloudflare.com), which is a common indicator of ephemeral or malicious infrastructure. SKILL.md explicitly directs the agent to execute a Python script (V19_Conformance_Test_Suite.py) that is not provided in the bundle, creating a risk of remote code execution if the agent attempts to fetch or generate the missing file. While framed as a 'trust infrastructure,' the combination of data exfiltration instructions and the use of suspicious external endpoints warrants a high-risk classification.