Dagny Nostr (nak)

• Analyzed: May 12, 2026, 4:16 AM
• Findings: 1
• Version: 0.1.4
• Hash: 24694c0ec4d5723db67408a9fe34709ac55553bdfafa82d8a086f0178addaf0b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `SKILL.md` instructs the agent to install the `nak` CLI tool using a `curl | sh` pipeline (`curl -sSL https://raw.githubusercontent.com/fiatjaf/nak/master/install.sh | sh`). This method executes arbitrary remote code without prior review, posing a significant supply chain risk and remote code execution vulnerability. While the stated purpose is to install a legitimate tool, this practice is inherently insecure and could be exploited if the remote source (GitHub repository or CDN) were compromised.