Dagny Nostr (nak)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:20 PM UTC
• Version: 0.1.4

Overview

This Nostr helper is coherent, but it asks users to install a CLI through an unverified remote shell script and handle a signing key for public posting without enough guardrails.

Review the nak installer before use and prefer a pinned release or verified package instead of curl-to-sh. Treat NOSTR_SECRET_KEY/nsec as an account takeover secret, keep it out of prompts and logs, and assume posts, tags, relays, and event IDs may be public and difficult to remove.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:13

Finding

Unverified Remote Installation Script Executed Directly by a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 13
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: High

Vulnerable Code:

markdown

- **Install** (script): `curl -sSL https://raw.githubusercontent.com/fiatjaf/nak/master/install.sh | sh`

Technical Analysis

The installation command retrieves a shell script from the mutable master branch of an external personal GitHub repository and immediately pipes the response into sh. The downloaded content is not pinned to a reviewed commit or release and is not authenticated with a publisher signature or verified against a checksum.

Consequently, the code executed during installation can change after the Skill itself has been reviewed. The remote script is not included in the audited project, so its behavior and any files, commands, or secondary payloads it uses cannot be verified by this audit. The optional recommendation elsewhere in the document to review the script does not make the displayed installation command safe.

The documented update procedure also instructs users to rerun this command to install the latest version, repeatedly exposing them to mutable remote code. Although installing nak supports the Skill's declared functionality, direct unverified execution is not the least-privilege or minimum-risk way to provide that dependency.

Attack Path

1. An agent or user follows the installation or update instructions in SKILL.md.
2. curl requests the current install.sh content from the repository's mutable master branch.
3. An attacker who compromises the repository, maintainer account, delivery path, or installation script substitutes malicious shell commands.
4. The response is passed directly to sh without local inspection, version pinning, checksum verification, or signature validation.
5. The malicious commands execute with the permissions of the user or agent running the installation.
6. Th ...[truncated 858 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | sh installation pattern.
2. Pin installation to a specific audited release, immutable commit, or versioned artifact rather than the mutable master branch.
3. Download the artifact to a local file before execution so it can be inspected:

   bash

   curl --fail --show-error --location --output install.sh \
     "https://raw.githubusercontent.com/fiatjaf/nak/<PINNED_COMMIT>/install.sh"
   

4. Publish and verify a trusted SHA-256 checksum and, preferably, a cryptographic publisher signature before running the downloaded file.
5. Review the downloaded script and its secondary downloads, then execute it explicitly only after verification.
6. Prefer a trusted, version-pinned package manager or signed release binary when the upstream project provides one.
7. Perform installation in a restricted environment without NOSTR_SECRET_KEY or unrelated credentials in scope.
8. Do not request elevated privileges unless a reviewed installation step demonstrably requires them. Install to a user-controlled directory where possible.
9. Document an explicit, version-pinned update process that repeats all integrity and authenticity checks rather than automatically installing the latest mutable content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill directs the agent to publish signed content and metadata to a public Nostr relay, but it does not explicitly warn that posts, tags, event IDs, and relay interactions are sent to an external public network and may be permanently replicated. In this context, omission of that warning can lead users to unintentionally disclose sensitive or deanonymizing information while believing the action is local or low-risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation handles a Nostr signing secret but does not clearly state that the nsec is highly sensitive and must never be exposed in prompts, logs, shell history, screenshots, or shared files. Because this skill signs and publishes events, compromise of the secret would allow full impersonation of the account and unauthorized posting from any relay accepting the signature.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

- **Generate a new key**: `nak key generate` (prints nsec + npub)
- **Save the secret**: store `NOSTR_SECRET_KEY` in a shell profile or a local `.env` with restricted permissions.
  - Example: `export NOSTR_SECRET_KEY="nsec1..."`
  - Optional: `chmod 600 .env` if you store it locally.
  - Prefer env vars over inline `--sec` in commands.

## Quick Start (common tasks)

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The installation instructions pipe a remotely fetched script directly into sh, which executes unpinned code from the network without integrity verification. If the upstream repository, transport path, or fetched script is compromised, users could execute arbitrary attacker-controlled code on their machine.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

## Install / Update nak
- **Repo**: https://github.com/fiatjaf/nak
- **Install** (script): `curl -sSL https://raw.githubusercontent.com/fiatjaf/nak/master/install.sh | sh`
- **Update**: re-run the install script above (it installs latest)
- **Tip**: review the script before running if you want to audit what it does.

Static analysis

No suspicious patterns detected.