Archon Nostr

This skill appears to perform the advertised job (derive a Nostr key from an Archon DID) but has several red flags you should consider before installing or running it: 1) Metadata is incomplete — the skill actually requires ARCHON_PASSPHRASE and node/npx/npm, but these are not declared. Expect the script to access your wallet mnemonic. 2) The SKILL.md recommends installing 'nak' by piping a remote script (curl | sh). Avoid running remote install scripts without review. 3) The included script runs `npm install` in /tmp, fetching packages at runtime; verify the exact packages and consider running in an isolated environment. 4) The script obtains your mnemonic via `npx @didcid/keymaster show-mnemonic` and embeds it into a node heredoc to derive keys — treat this as handling of the most sensitive secret you own. 5) The skill instructs you to store the derived private key on disk and to publish profile events to public Nostr relays; ensure you trust the relays and secure the stored key (correct file permissions, hardware wallet if possible). Recommended actions: inspect and audit the remote install script and the npm packages, run the derivation in an isolated or disposable environment first, ensure metadata is corrected to list required env vars and binaries, and consider deriving keys with an air-gapped or offline flow if you want maximum safety.