Security audit

nostr-auth

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with Nostr sign-in, but its helper can sign non-authentication events and send signed events to arbitrary callback URLs.

Review before installing. Use this only with challenges and callback URLs from services you trust, prefer dry-run inspection, avoid plaintext or local/private callback URLs, and do not pass arbitrary event templates unless you intentionally want this derived Nostr identity to sign them.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/nostr_auth.js:271
Finding: Authentication-Only Signing Scope Is Not Enforced
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/nostr_auth.js:213
Finding: Unrestricted Callback URL Permits Internal Requests and Plaintext Submission
Content: View full analysis
{ const url = new URL(urlInput); const mod = url.protocol === 'https:' ? https : http; const body = Buffer.from(payload, 'utf8'); const req = mod.request(url, { method: 'POST', timeout: 15000, headers: { 'Content-Type': 'application/json', 'Content-Length': body.length, Accept: 'application/json', 'User-Agent': `nostr-auth/${VERSION}` }, }, (res) => { const chunks = []; res.on('data', (c) => chunks.push(c)); res.on('end', () => resolve({ status: res.statusCode, body: Buffer.concat(chunks).toString('utf8') })); }); req.on('timeout', () => req.destroy(new Error('Request timed out'))); req.on('error', reject); req.end(body); }); } ``` ```javascript const res = await postJSON(o.callback, JSON.stringify({ event })); ``` ### Technical Analysis The callback is accepted without an origin allowlist, HTTPS requirement, hostname validation, or address-range filtering. Both `http:` and `https:` URLs are supported. The implementation does not reject loopback, private, link-local, or cloud metadata destinations. When callback input can be influenced by an untrusted challenge provider, page, API response, or prompt, the helper can be induced to send an HTTP POST from the agent's host to an internal service that is inaccessible to the attacker directly. The POST body is fixed to a signed-event wrapper, which limits arbitrary request construction, but internal endpoints can still receive an unintended state-changing request. Permitting plaintext HTTP also exposes the complete signed event to network observers. Depending on the service's challenge validation, an intercepted event may be repla ...[truncated 1496 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/nostr_auth.js:160
Finding: Existing Master-Key Files Are Used Without Permission or Symlink Validation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.