T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:81- Finding
Nostr Private Key Exposed Through Command-Line Arguments
- Content
View full analysis
" \ --tag p="" \ --tag amount="" \ --tag t="" \ --tag status="proposed" \ --tag funding_type="patron" \ -c '{"title":"Task Title","description":"Detailed description...","requirements":"What must be delivered"}' \ --sec "" \ wss://relay.damus.io wss://nos.lol wss://relay.primal.net ``` ```bash # Update to funded (add zap receipt reference) nak event -k 33401 \ --tag d="" \ --tag status="funded" \ --tag e="" \ # ... all other original tags ... --sec "" \ wss://relay.damus.io ``` ```bash nak event -k 951 \ --tag e="" \ --tag p="" \ -c '{"delivery":"Description of completed work","evidence":"Link or proof"}' \ --sec "" \ wss://relay.damus.io ``` ```bash nak event -k 3402 \ --tag e="" \ --tag e="" \ --tag p="" \ --tag p="" \ --tag p="" \ --tag resolution="successful" \ --tag a="33401::" \ -c '{"resolution_details":"Work met all requirements"}' \ --sec "" \ wss://relay.damus.io ``` ### Technical Analysis Every documented event-publishing workflow directs the user or agent to supply a Nostr secret key through the `--sec` command-line option. After replacing the placeholder with a real `nsec`, the secret becomes part of the process argument vector. Depending on the operating-system configuration and execution environment, command-line arguments can be exposed through: - Process inspection utilities and process metadata. ...[truncated 2177 chars]- Remediation
View remediation