Security audit

Freedom Preserving Protocol — Trust & Handshake

Security checks across malware telemetry and agentic risk

Overview

This plugin is a coherent trust and handshake integration that persists local trust state and keys as disclosed, without evidence of hidden exfiltration or destructive behavior.

Install this only if you want this workspace to maintain local FPP trust identity and governance state. Review the .openclaw/workspace paths and steward/quorum configuration, because finalized mandates or admitted emergency overrides may be consumed by a separate enforcement plugin.

SkillSpector

By NVIDIA

SkillSpector was not run because this plugin release contains no bundled skills.

VirusTotal

62/62 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/@ovrsr/fpp-protocol-core/dist/steward-authorization.d.ts:13
Evidence: readonly authorization: "[REDACTED]";

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/@ovrsr/fpp-protocol-core/dist/steward-authorization.js:30
Evidence: authorization: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/@ovrsr/fpp-protocol-core/src/steward-authorization.ts:36
Evidence: authorization: "[REDACTED]",