Nostr Wallet Connect (NWC) bridge for mdk-agent-wallet, which is self-custodial Bitcoin Lightning wallet for AI agents.

• Outcome: Review
• Latest audit: Aug 11, 2026 · 12:56 PM UTC
• Version: 1.1.0

Overview

This wallet bridge is transparent about its purpose, but it needs review because its spending controls are weak and a documented receive/send permission split is not enforced by the code.

Install only if you are prepared to treat this as a remotely reachable wallet control surface. Keep NWC_AUTO_REGISTER disabled, use tiny budgets, keep state.json and generated NWC URIs secret, and do not rely on receive/send connection names as enforced spending controls until the code checks allow_methods before wallet actions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documentation describes a service that uses environment variables and network access to expose a wallet bridge, but it does not declare those capabilities as permissions. That omission reduces transparency for users reviewing the skill and can cause them to approve installation without understanding that the skill will open relay connections and handle sensitive wallet-related secrets.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: When NWC_AUTO_REGISTER is enabled, any unknown client pubkey that sends a request can be silently added as an authorized connection and immediately gain wallet API access. In the context of a wallet bridge, this bypasses the explicit provisioning model established by new-connection and can permit unauthorized balance queries, invoice creation, and potentially spending depending on default permissions and budget settings.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The usage flow mentions generating a separate NWC URI for send/spending permission, but it does not clearly warn that anyone possessing that URI can exercise wallet spending authority within the granted budget and permissions. In the context of a wallet bridge, this is especially dangerous because users may paste or store the URI insecurely, leading to unauthorized invoice payments.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: Automatic registration of unknown clients creates wallet access with no user-facing warning, approval, or secure onboarding, which is especially dangerous for a service that can control funds. In this skill's context, the bridge is specifically exposing a local wallet over Nostr Wallet Connect, so silent enrollment materially lowers the barrier for unauthorized remote access.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "",
  "license": "ISC",
  "dependencies": {
    "nostr-tools": "^2.23.0"
  }
}

• Confidence: 95% confidence
• Finding: The dependency is version-ranged with a caret (^2.23.0), which allows newer compatible releases to be installed over time. This can introduce supply-chain risk and reduce build reproducibility, especially for a wallet/Nostr bridge where dependency behavior directly affects cryptographic messaging and request handling.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.