T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:19
- Finding
- Private Nostr Keys Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 19–21 **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: High ### Vulnerable Code Snippet ```markdown ## Identity Handling - **Querying**: Use `npub...` or hex pubkey with the `-a` flag. - **Posting**: Use `nsec...` or hex private key with the `--sec` flag. ``` ### Technical Analysis The skill instructs the agent to provide a Nostr private key directly to the `nak` command through the `--sec` command-line option. Command-line arguments can be visible through local process-inspection interfaces and may also be captured by terminal logs, PTY session recording, debugging systems, audit tooling, or command-history mechanisms. The exposure risk is increased by the required `script -c` wrapper because the full command is passed as a string through an additional process and shell execution layer. The project does not provide instructions for preventing the private key from being logged or retained. ### Attack Path 1. A user supplies an `nsec` or hexadecimal Nostr private key for a posting operation. 2. The agent constructs a `nak` command containing the key as the value of `--sec`. 3. The command is passed through the documented `script -c` PTY wrapper. 4. A local process observer, logging system, debugging facility, or retained session record captures the command argument. 5. An attacker obtains the private key and uses it independently to sign and publish Nostr events as the victim. ### Impact Assessment Disclosure of the private key grants control of the corresponding Nostr identity. An attacker could impersonate the victim, publish fraudulent signed events, alter identity metadata, or perform any other action authorized by that key. The issue does not itself provide elevated operating-system privileges. Its scope is the Nostr identity controlled by the exposed key, although subsequent social or operational consequences may extend beyond the ...[truncated 16 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not accept or embed raw `nsec` or hexadecimal private keys in command-line arguments. - Prefer a supported external signer, hardware-backed signer, or operating-system credential store. - If `nak` supports secret input through a protected file descriptor, standard input, environment-independent signer, or restricted credential file, use that mechanism instead of `--sec`. - Ensure that secret-bearing commands are excluded from shell history, PTY transcripts, debug logs, telemetry, and audit output. - Document that users must never provide private keys in prompts or other persistently recorded interfaces. - Apply restrictive permissions to any unavoidable temporary credential resource and securely remove it immediately after use. ]]>