Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Nano wallet and payment helper; it handles real funds, but I found no hidden exfiltration, persistence, or deceptive behavior.
Install only if you are comfortable letting the skill sign and broadcast Nano payments you explicitly request. Keep NANO_SEED out of shared shells, logs, CI, and screenshots; keep payment caps low; verify quoted prices and recipients before paying; and consider pinning dependencies before using it with meaningful funds.
Referenced artifact was not completely inspected
description: Spending cap for scripts/client-x402.js in NANO as decimal text (0.05, 1, 0.000001), default 0.01. A 402 quote above it is refused and nothing is s
Referenced artifact was not completely inspected
description: Spending cap for scripts/client-x402.js in NANO as decimal text (0.05, 1, 0.000001), default 0.01. A 402 quote above it is refused and nothing is s
Referenced artifact was not completely inspected
description: Spending cap for scripts/client-x402.js in NANO as decimal text (0.05, 1, 0.000001), default 0.01. A 402 quote above it is refused and nothing is s
Referenced artifact was not completely inspected
description: Spending cap for scripts/client-x402.js in NANO as decimal text (0.05, 1, 0.000001), default 0.01. A 402 quote above it is refused and nothing is s
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
change daily, and each live entry carries a reachability probe.
curl -s https://pursekeeper.dev/sellers.json | node -e '
let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{for(const s of JSON.parse(d).sellers)
console.log(s.live.reachable?"up ":"down",s.id,"|",s.price,"|",s.endpoint)})'
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
const msg = String(e.message);
console.error('process failed (' + msg.slice(0, 80) + '); checking whether the block landed');
// The follow-up read must not be allowed to fail on its own: unprotected, its account_info error ended the command
// with no warning naming the hash, and a rerun of `send` built on the landed block and paid twice (Ops Control HQ,
// 2026-09-28 22:28 UTC). Same rule as landed(): not knowing is not "did not land".
try { await refresh(); }
catch (e2) { throw stop('process failed (' + msg.slice(0, 80) + ') and the follow-up account_info read failed (' + e2.message + '): cannot tell whether ' + hash + ' landed'); }
The skill explicitly instructs use of environment variables containing wallet seed material and network-capable commands, but it does not declare any tool scope or permission boundaries. In an agent ecosystem, that omission increases the chance the skill is invoked with broader-than-expected access to secrets and outbound network actions, which is dangerous because the skill centers on cryptocurrency payments and seed handling.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s -D headers.txt -o quote.json -X POST https://nano-gpt.com/api/x402/v1/chat/completions \
-H "Content-Type: application/json" -H "x-x402: nano" --data-binary @request.json
The documentation instructs users to pass a Nano seed via the NANO_SEED environment variable without any warning about secret-handling risks. Environment variables are commonly exposed through shell history, process inspection, crash reports, CI logs, and inherited child processes, so this guidance can lead to accidental wallet compromise and loss of funds.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Goonbot Utility Suite: POST /v1/attest/response (Ed25519 attestation of any JSON)
- id: `oreomuncher-attest`; operator: OreoMuncher45 (agent operator; GitHub OreoMuncher45), api.shehriyar.ink, 38 pay-per-call endpoints
- what: Signs a canonical (sorted-key) JSON payload with the service's Ed25519 key and returns the canonical sha256, raw sha256, signature and public key; optional label and Base block-number anchor. Independently verifiable: recompute the canonical hash, verify the signature over the sorted-key JSON of the attestation object.
- endpoint: https://api.shehriyar.ink/v1/attest/response
- price: Ӿ0.01 per call (or $0.005 USDC on Base; both rails in one accepts array)
- how to pay: Stock x402 v2: 402 with PAYMENT-REQUIRED carrying two accepts entries; the nano:mainnet one is scheme exact, XNO, 0.01 in raw, payTo nano_1zqdw3…, maxTimeoutSeconds 300, extra work required at fffffff800000000. Sign a send block and retry with PAYMENT-SIGNATURE; the seller settles through facilitator.pursekeeper.dev and answers 200 with PAYMENT-RESPONSE. api/examples/client-x402.js works unchanged. Python x402ResourceServer with x402-nano-exact installed from a durable path. Only this one endpoint has the Nano rail so far.
- docs: https://api.shehriyar.ink/openapi.json
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Goonbot Utility Suite: POST /v1/attest/response (Ed25519 attestation of any JSON)
- id: `oreomuncher-attest`; operator: OreoMuncher45 (agent operator; GitHub OreoMuncher45), api.shehriyar.ink, 38 pay-per-call endpoints
- what: Signs a canonical (sorted-key) JSON payload with the service's Ed25519 key and returns the canonical sha256, raw sha256, signature and public key; optional label and Base block-number anchor. Independently verifiable: recompute the canonical hash, verify the signature over the sorted-key JSON of the attestation object.
- endpoint: https://api.shehriyar.ink/v1/attest/response
- price: Ӿ0.01 per call (or $0.005 USDC on Base; both rails in one accepts array)
- how to pay: Stock x402 v2: 402 with PAYMENT-REQUIRED carrying two accepts entries; the nano:mainnet one is scheme exact, XNO, 0.01 in raw, payTo nano_1zqdw3…, maxTimeoutSeconds 300, extra work required at fffffff800000000. Sign a send block and retry with PAYMENT-SIGNATURE; the seller settles through facilitator.pursekeeper.dev and answers 200 with PAYMENT-RESPONSE. api/examples/client-x402.js works unchanged. Python x402ResourceServer with x402-nano-exact installed from a durable path. Only this one endpoint has the Nano rail so far.
- docs: https://api.shehriyar.ink/openapi.json
The dependency uses a caret range (^2.5.0), which allows future minor and patch releases to be installed implicitly. In a security-sensitive skill that handles Nano wallet and payment functionality, this increases supply-chain risk because a compromised or breaking upstream release could be pulled in without explicit review, affecting transaction handling or secret material.
"name": "pursekeeper-skill-scripts",
"private": true,
"description": "Scripts for the pursekeeper ClawHub skill: a Nano wallet with no node, and an x402 exact client for nano:mainnet.",
"dependencies": { "nanocurrency": "^2.5.0" }
}
No suspicious patterns detected.