Freedom Preserving Protocol

• Outcome: Review
• Latest audit: Jul 17, 2026 · 10:29 PM UTC
• Version: 1.3.9

Overview

This skill is a disclosed, opt-in governance framework that writes local adoption and audit records only after user-directed adoption.

Install only if you want this agent to adopt persistent constitutional self-governance. Review package.json first, run installs from the lockfile if possible, and remember the optional enforcement and trust plugins are separate packages with their own risk surface. Adoption will append to local agent state and audit files; use revoke if you later want it stopped.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Session Persistence

Medium

• Category: Rogue Agent

Content

# Constitution Audit (Heartbeat)

**Run this heartbeat only after prior adoption** of the Freedom Preserving Protocol (SOUL.md adoption block present and not revoked). If adoption was never completed, or a `.fpp-revoked` marker exists, do **not** run this audit and do **not** create an audit file.

This skill is a **post-adoption opt-in** integrity check (every 4+ hours when the runtime schedules heartbeats). It is not ambient surveillance: audit writes were disclosed when the user consented to adoption (path below).

• Confidence: 84% confidence
• Finding: The skill instructs periodic, persistent append-only logging to a workspace file on every heartbeat, which creates cross-session state and ongoing data retention. Although the content is described as summary statistics and consent-gated, the mechanism still establishes durable session persistence that can be abused for tracking behavior over time, can survive beyond a single interaction, and may be triggered automatically without fresh per-run user awareness.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"self-test": "npx tsx scripts/skill-self-check.ts"
  },
  "dependencies": {
    "@noble/ed25519": "^2.1.0",
    "@noble/hashes": "^1.4.0"
  },
  "devDependencies": {

• Confidence: 90% confidence
• Finding: The dependency uses a caret range, which permits automatic installation of newer minor/patch versions rather than an exact reviewed version. In a skill with shell execution and filesystem write permissions, a compromised or breaking upstream release could affect local execution during install or script runs, increasing supply-chain risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "dependencies": {
    "@noble/ed25519": "^2.1.0",
    "@noble/hashes": "^1.4.0"
  },
  "devDependencies": {
    "tsx": "^4.19.0"

• Confidence: 90% confidence
• Finding: The dependency is not pinned to an exact version, allowing resolution to future published releases within the semver range. Although common in Node projects, this creates avoidable supply-chain exposure, especially for a package whose scripts may influence agent behavior and has write/execute-capable skill permissions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"@noble/hashes": "^1.4.0"
  },
  "devDependencies": {
    "tsx": "^4.19.0"
  },
  "engines": {
    "node": ">=22.19"

• Confidence: 95% confidence
• Finding: The devDependency tsx is also specified with a caret range and is invoked through npx in multiple package scripts. This is more dangerous than a passive library dependency because it is directly executed tooling; if a malicious or compromised allowed version is resolved, it could run code during verification, adoption, revoke, or audit workflows.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/verify-install.ts:278