Security audit

Nostr Army Knife (nak)

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its Nostr CLI purpose, but it gives high-impact key, wallet payment, and file upload examples without enough safety boundaries.

Review carefully before installing. Use only low-value or test Nostr keys unless you have a secure secret-handling workflow, avoid putting real nsec values in prompts or command history, require explicit confirmation for posts and wallet payments, and only upload files you intentionally want to disclose to the named server.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:25
Finding: Private Nostr Keys Exposed Through Command-Line Arguments
Content: View full analysis
wss://relay.damus.io # SKILL.md:29 nak event -c "I agree!" -e --sec wss://relay.damus.io # SKILL.md:33 echo '{"name":"bob","about":"builder"}' | nak event -k 0 --sec wss://relay.damus.io # SKILL.md:83 nak encrypt --sec --target "Secret message" # SKILL.md:87 nak decrypt --sec --source # SKILL.md:94 nak wallet --sec # SKILL.md:98 nak wallet pay --sec lnbc1... # SKILL.md:106 nak blossom upload --server https://cdn.example.com --sec ./image.png ``` ### Technical Analysis The Skill repeatedly recommends passing a Nostr private key through the `--sec` command-line argument. When an agent or user replaces the placeholders with a real `nsec` or hexadecimal private key, that secret becomes part of the process invocation. Depending on the operating environment, command-line arguments may be exposed through: - Shell history and command auditing. - Process inspection utilities and process metadata. - Terminal capture, debugging, telemetry, or session recording. - Agent execution transcripts and tool-call logs. - Monitoring systems that record complete process invocations. - Error reports that reproduce the original command. This behavior is not required for the Skill's declared network functionality if `nak` supports a safer secret-input mechanism. It therefore exceeds minimum safe exposure even though possession of a private key is legitimately required for signing, decryption, wallet operations, and authenticated uploads. The documented network operations themselves—relay publication and queries, wallet co ...[truncated 2051 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly documents use of secret keys for signing and wallet operations, including paying Lightning invoices, but does not warn that these credentials grant control over identity and funds or that payments may be irreversible. In an agent context, this omission materially increases the chance that a user or agent will pass sensitive keys on the command line or authorize unintended transactions without adequate confirmation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The Blossom upload example shows transmitting a local file to a remote server but provides no warning that file contents leave the local environment and may be stored or indexed by a third party. In an agentic setting, this can lead to accidental exfiltration of sensitive local files if the command is reused or adapted without clear user awareness.
Content: No source excerpt is available for this finding.