ClawHub
Back to skill

Security audit

nostr-auth

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it signs Nostr login challenges using a local key and only sends results to a user-specified callback.

Before installing, understand that this creates or uses an agent Nostr identity stored in a local master key file and can authenticate to services when given a challenge and callback. Use dry-run first, verify callback URLs, and do not pass a valuable personal Nostr private key unless you intend this tool to use that identity.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:66