Security audit

Archon Nostr

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent identity-linking purpose, but it handles wallet secrets and private signing keys with risky install, storage, and publishing patterns that deserve manual review before use.

Review this skill carefully before installing. Use it only in an isolated environment, avoid running the curl|sh installer, pin and audit dependencies first, do not expose the nsec in terminal logs or command arguments, and do not publish DID/profile data to relays unless you intentionally want that public linkage.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:14
Finding: Mutable Remote Installation Script Is Executed Directly by a Shell
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/derive-nostr.sh:9
Finding: Unpinned npm and npx Dependencies Execute While Wallet Secrets Are Accessible
Content: View full analysis
/dev/null) if [ -z "$MNEMONIC" ]; then echo "Error: Could not get mnemonic. Is ARCHON_PASSPHRASE set?" >&2 exit 1 fi # Install dependencies if needed if [ ! -f "$DEPS_DIR/node_modules/bip39/package.json" ]; then echo "Installing dependencies..." >&2 mkdir -p "$DEPS_DIR" cd "$DEPS_DIR" npm install --silent bip39 @scure/bip32 secp256k1 bech32 >/dev/null 2>&1 cd - >/dev/null fi ``` The documentation also executes an unversioned package through `npx`: ```bash npx @didcid/keymaster set-property YourIdName nostr \ '{"npub":"npub1...","pubkey":""}' ``` ```bash npx @didcid/keymaster resolve-id | jq -r '.didDocument.verificationMethod[0].publicKeyJwk.x' ``` ### Technical Analysis No exact package versions, lockfile, integrity hashes, or signature verification are used. `npx @didcid/keymaster` may obtain and execute the package version currently resolved by the registry. Similarly, `npm install` resolves current versions of four packages and their transitive dependencies. npm package lifecycle scripts may execute during installation. The resulting JavaScript packages are subsequently loaded into a process that receives the wallet mnemonic and derives the private key. This creates a supply-chain trust boundary around highly sensitive wallet material. ### Attack Path 1. An upstream package, maintainer account, registry entry, or transitive dependency is compromised, or an incompatible malicious version is published. 2. The user runs the derivation script or a documented `npx` command. 3. npm/npx resolves the current unpinned package version. 4. Package lifecycle code or run ...[truncated 695 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/derive-nostr.sh:7
Finding: Predictable Shared Temporary Directory Permits Local Module Substitution
Content: View full analysis
/dev/null) if [ -z "$MNEMONIC" ]; then echo "Error: Could not get mnemonic. Is ARCHON_PASSPHRASE set?" >&2 exit 1 fi # Install dependencies if needed if [ ! -f "$DEPS_DIR/node_modules/bip39/package.json" ]; then echo "Installing dependencies..." >&2 mkdir -p "$DEPS_DIR" cd "$DEPS_DIR" npm install --silent bip39 @scure/bip32 secp256k1 bech32 >/dev/null 2>&1 cd - >/dev/null fi # Run derivation cd "$DEPS_DIR" ``` The Node process then loads modules from that directory: ```javascript const bip39 = require('bip39'); const { HDKey } = require('@scure/bip32'); const secp256k1 = require('secp256k1'); const { bech32 } = require('bech32'); ``` ### Technical Analysis The script uses the fixed path `/tmp/archon-nostr-deps`, which is predictable and potentially shared among local users or processes. It does not validate ownership, permissions, file types, or symbolic links. The dependency installation decision checks only for `node_modules/bip39/package.json`. If that marker exists, the script skips installation and trusts every module under the directory. A local attacker able to prepare or modify the path can substitute malicious JavaScript for any required package. The malicious module is loaded after the mnemonic has been obtained and embedded into the Node program. ### Attack Path 1. A local attacker predicts the fixed `/tmp/archon-nostr-deps` path. 2. Before the victim runs the script, the attacker creates that directory or redirects it through a symbolic link. 3. The attacker adds the checked `bip39/package.json` marker and malicious implementations of one or more required modules. 4. The victim runs `derive-nostr.sh`. 5. ...[truncated 675 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/derive-nostr.sh:29
Finding: Unescaped Mnemonic Is Interpolated into Executable JavaScript Source
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:43
Finding: Nostr Private Key Is Exposed Through the Process Argument Vector
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The stated purpose is key derivation/unification, but the documented behavior extends into secret extraction/output and runtime package installation. That mismatch is dangerous because users may consent to a narrow identity operation while the workflow handles and exposes highly sensitive material and pulls additional code from external sources.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script prints the derived nsec private key to stdout, which exposes secret key material to terminal history, logs, shell capture, calling processes, CI output, or transcript systems. In this skill's context, the output is directly derived from the user's Archon mnemonic, so disclosure enables complete impersonation and loss of control over the linked Nostr identity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions explicitly output and persist the Nostr private key (nsec) to disk without strong warnings, safer alternatives, or lifecycle guidance. Exposing the secret in shell history, terminal logs, or a predictable file path can lead to account takeover and permanent compromise of the linked identity.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 87% confidence
Finding: Creating a persistent directory and storing the derived nsec there causes long-lived secret retention on disk. In the context of a private signing key that links DID and Nostr identities, persistence significantly increases the blast radius of local compromise, backups, malware, or accidental disclosure.
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
Save Keys

bash
mkdir -p ~/.clawstr # Save the nsec output from above echo "nsec1..." > ~/.clawstr/secret.key chmod 600 ~/.clawstr/secret.key

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
mkdir -p ~/.clawstr

Save the nsec output from above

echo "nsec1..." > ~/.clawstr/secret.key chmod 600 ~/.clawstr/secret.key

text
## Update DID Document

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill claims to derive a Nostr identity, but it also instructs users to mutate DID state and publish to external relays. This broadens the trust boundary from local derivation to persistent identity changes and public network actions, increasing the chance of unintended disclosure or irreversible mistakes.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 83% confidence
Finding: Using npx @didcid/keymaster without pinning a specific version causes the latest package version to be fetched and executed at runtime. This creates supply-chain risk and makes behavior non-reproducible; a compromised or malicious upstream release could change or exfiltrate wallet-related data in a workflow already handling identity metadata.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Publishing profile data to public Nostr relays is not necessary to derive or unify keys, so it introduces extra exposure unrelated to the core purpose. In context, this is more dangerous because the same workflow also handles a private key, creating a direct path from derivation to public broadcasting.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The workflow publishes profile content to public relays without an explicit warning that the transmission is public, networked, and potentially permanent. Users may unintentionally disclose identifying information, especially since the sample content links a DID to a Nostr profile.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 83% confidence
Finding: The unpinned npx @didcid/keymaster invocation executes whatever current version npm resolves, which is risky in a security-sensitive identity workflow. Because this skill operates adjacent to DID and key material, upstream package compromise could have outsized consequences.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The script depends on npx @didcid/keymaster without pinning an exact version, so execution may fetch and run whatever package version is current at runtime. In a skill that retrieves a wallet mnemonic and derives private key material, a compromised or malicious upstream release would directly expose seed phrases and derived secrets, making the unpinned dependency especially dangerous.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: At the point where the mnemonic is fetched, the script actively executes npx @didcid/keymaster show-mnemonic without version pinning, meaning untrusted code can run immediately before handling the most sensitive secret in the workflow. If the package supply chain is compromised, the mnemonic can be exfiltrated at the exact moment it is accessed, leading to total wallet compromise.
Content: No source excerpt is available for this finding.

External Script Fetching

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: Piping a remote script from GitHub directly into sh executes unreviewed code immediately and inherits the user's environment, which may include sensitive variables such as ARCHON_PASSPHRASE. In a skill dealing with wallets and derived private keys, this supply-chain pattern is especially dangerous because compromise of the script source can lead to secret theft or arbitrary code execution.
Content: Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.
md
- Archon wallet with existing DID - `ARCHON_PASSPHRASE` environment variable set - `nak` CLI: `curl -sSL https://raw.githubusercontent.com/fiatjaf/nak/master/install.sh | sh` ## Derive Keys

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Missing User Warnings

Missing User Warnings

Session Persistence

Save Keys

Sudo/Root Execution

Save the nsec output from above

Description-Behavior Mismatch

Rp1

Context-Inappropriate Capability

Missing User Warnings

Rp1

Rp1

Rp1

External Script Fetching

Static analysis