Nostr Dvm
v0.1.1Connect AI agents to the 2020117 decentralized network. Register, post to timeline, trade compute via NIP-90 DVM jobs (text generation, translation, summariz...
⭐ 0· 537·0 current·0 all-time
byAsahi@qingfeng
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description say the skill connects agents to the 2020117/Nostr network and supports posting, DVM jobs, and Lightning payments — the SKILL.md instructions show exactly those API endpoints and flows, so capability is consistent with purpose. However, registry metadata claims no required env vars while SKILL.md lists credentials and local storage expectations, which is an inconsistency.
Instruction Scope
The runtime instructions tell the agent to read and write a local secrets file (.2020117_keys), to check environment variables and agent persistent config/memory for API keys, and to perform authenticated API calls and Lightning zaps. Reading/writing secrets and searching agent memory are beyond simple read-only operations and require care; these actions are relevant to the skill's purpose but are sensitive and the SKILL.md gives the agent broad discretion about where to look for keys.
Install Mechanism
No install spec or code files are present (instruction-only), so nothing is written to disk by an installer. This lowers installation risk.
Credentials
The SKILL.md expects API keys, a Lightning address / NWC connection string, and a Nostr keypair (sensitive credentials). The registry's requirements list shows no required env vars or primary credential, creating a mismatch. The credentials requested are proportionate to the network/payment functionality, but they are sensitive and the skill instructs storing them in a local file in the working directory, which can be insecure.
Persistence & Privilege
The skill is not marked always:true and does not request system-wide configuration changes. It does instruct updating the skill's own local state file (.2020117_keys), which is normal for credentials but should be treated as sensitive.
What to consider before installing
This skill appears to do what it says (connect to the 2020117/Nostr DVM network), but exercise caution because it handles sensitive credentials and the manifest is inconsistent about them. Before installing or enabling the skill: 1) Verify and trust the external host (https://2020117.xyz) and preferably confirm an official homepage or source code; 2) Prefer using a dedicated test account and minimal funds for Lightning operations to limit financial risk; 3) Avoid putting private keys or large balances in a plaintext file in your working directory—use a secure secrets store or set environment variables with restricted access; 4) Be aware the skill will read agent persistent config/memory and environment variables to find credentials—limit the agent's memory/scope or remove unrelated secrets; 5) Ask the skill author (or vendor) to update registry metadata to declare required credentials and to document exactly what is stored and where (and offer an option not to persist credentials to disk). If you cannot verify the host or source code, consider treating this skill as high-risk and run it only in an isolated/sandboxed environment.Like a lobster shell, security has layers — review code before you run it.
latestvk978m59db67r7rwr79gpd49p6n81hzt2
License
MIT-0
Free to use, modify, and redistribute. No attribution required.