Freeport — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Freeport (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Decentralized P2P marketplace over Nostr. Users broadcast trade intents into topic-scoped markets; personal agents discover counterpart intents and negotiate automatically. Humans confirm final deals. No central operator, no matching server — relays are dumb pub/sub, all logic is client-side.
packages/freeport-self-hosted(docker compose up -d), or any desktop install can host the app for your network with freeport --serve.
decisions, quick start, CLI.
https://github.com/user-attachments/assets/506c82ac-c5eb-415d-b981-ba14c4f165bc
_Also on the landing page._
sellers, riders, drivers meet over Nostr, settle in Lightning or cash. Nothing in between needs permission to exist.
people own their reputation, the market self-regulates.
ceiling on how greedy the big platforms can get.
investor deck.
platform. Run it or fork it.
support line, no refunds, no central authority. Your judgment comes first, backed by opt-in safeguards no operator runs: a reputation system (karma, co-signed receipts, web-of-trust), escrow arbitration (examples/arbitrator), ID verification (examples/id-verification), and insurance (examples/insurance-store) priced from reputation. You choose how much of the safety net to use.
macOS/Windows/Linux with self-update — plus a single-file offline copy: the whole app in one HTML file that runs from file://, no install, no server.
stablecoin (USDT/USDB) wallet (Breez SDK/Spark). Keys derive from your Nostr key — one backup covers identity and funds. Lightning address ([email protected]), on-chain, QR scan, local-currency balances, and one-tap Pay / Pay QR on confirmed deals. Bring your own wallet over NWC instead if you prefer. Spark is a young trust-minimized L2 — treat it as a spending wallet.
counts, web-of-trust weighting. Sybil resistance stays open — treat zero-history identities with caution.
replies, emoji reactions, disappearing messages, delivery/read receipts, voice messages, location sharing, in-chat search and Lightning payments. Between updated clients it upgrades to NIP-17 gift wrap, so relays can't even see who talks to whom.
end-to-end encrypted, signaling over encrypted DMs — no call server), with screen sharing on web. Optional TURN fallback.
NIP-15 storefronts — durable seller listings with a conversational "chat with seller" checkout.
confirmed deals — the buyer holds the preimage, the seller can only settle on release, unreleased funds auto-refund. The Lightning protocol enforces the lock; nobody ever holds the money in between.
your portable identity (NIP-07) and wallet (WebLN + Spark/stablecoin) — sandboxed behind a permission firewall where every sensitive action needs your approval (architecture & threat model). A dedicated Apps tab hosts the launcher — a home-screen-style grid (add any app by URL or QR, drag to rearrange), with the wallet as its first tile; your apps and their grants travel with the account backup. One <script> tag makes a page work on web too. Mini-app examples:
examples/esim-store — eSIM shop withSpark/stablecoin checkout, live at apps.freeport.network/esim-store
examples/insurance-store — travel insurancequotes underwritten from npub-derived reputation, with a downloadable PDF certificate, live at apps.freeport.network/insurance-store
examples/id-verification — a paid identity /licence verification service: submit documents, book a video call, and get a shareable verification link for your profile, live at apps.freeport.network/id-verification
examples/arbitrator — decentralized disputearbitration: an escrow with the arbitrator as a conditional key, encrypted evidence (NIP-44), and a fee only charged when a dispute is actually raised — the arbitrator's npub karma is their license, live at apps.freeport.network/arbitrator
and it drafts your post; incoming chat messages auto-translate. Runs entirely on your device (Apple Intelligence / Android ML Kit + Gemini Nano / Chrome built-in AI) — your words never leave it.
market feeds in groups, one-tap broadcast of organic posts, personal pings.
Custody (payments stay self-custodial wallet-to-wallet; even escrow is trust-minimized HODL invoices, never a held balance), dispute resolution, vetting, anti-sybil — all deliberately deferred.
BTC: bc1ps44wjx3wpu4s0xj746gz2lu45nspsm9059d3ym8xz0nrhu4psyasdgwwhx
MIT (LICENSE). Freeport exists to be forked: any community can stand up its own market — own name, city, vertical, relays and services — by changing configuration, not architecture. [FORKING.md](FORKING.md) lists every deployment-specific value; CONTRIBUTING.md covers dev setup and style.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.