Security audit

Nostr Nak

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent Nostr CLI purpose, but it under-discloses risky private-key handling and encourages shell-string command templates that can be unsafe with user-supplied values.

Review before installing. Only use this skill if you can keep Nostr private keys out of prompts, command history, logs, and transcripts, and ensure any user-provided relay or key values are strictly validated and shell-escaped before being used in `script -c` commands. Prefer safer signer or credential-storage workflows when posting.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:19
Finding: Private Nostr Keys Exposed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:9
Finding: Shell Command Injection Through Unvalidated Values in the PTY Command Template
Content: View full analysis
-l 5" /dev/null | cat` ``` ### Technical Analysis The `-c` option supplies `script` with a single command string that is interpreted through a shell. The documented template places variable values such as public keys and relay addresses inside that shell command without requiring strict format validation or shell-safe escaping. The skill explicitly permits users to override the default relays. If an agent directly substitutes a user-controlled relay or public-key value into the template, shell metacharacters, substitutions, quoting characters, or command separators can escape the intended `nak` invocation and introduce additional commands. This is a command-construction weakness in the skill instructions rather than executable source code shipped by the package. Exploitation therefore depends on an implementing agent inserting untrusted input into the template without sanitization, as the current instructions allow. ### Attack Path 1. An attacker asks the agent to use a specially crafted relay or identifier containing shell syntax. 2. The agent follows the skill instructions and substitutes that value into the `script -q -c "nak req ..."` command string. 3. `script -c` passes the constructed string to a shell. ...[truncated 733 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs users to supply an nsec or hex private key directly on the command line via --sec without any warning about secret handling. Command-line secrets are commonly exposed through shell history, process listings, logs, transcripts, or agent output, making credential compromise more likely in an agent/PTY-based workflow.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.