Security audit

Nostr Social

Security checks across malware telemetry and agentic risk

Overview

The skill appears aligned with Nostr social and wallet use, but it handles identity keys, wallet seed material, public posts, DMs, deletion, payments, and monitoring with insufficiently clear confirmations and scoping.

Review before installing. This skill may create or reuse keys and wallet seed material, connect to third-party Nostr/Cashu/Lightning/avatar services, monitor messages, and publish public or payment-related actions. Install only if you are comfortable with those capabilities, understand where the seed and keys are stored, and can require confirmations for posts, DMs, deletions, and any wallet or zap operation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (14)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes networked services and accesses user-home paths and environment-dependent locations, yet declares no permissions or capability boundaries. This creates a transparency and consent problem: an agent or user may install it without understanding that it can make outbound connections, create persistent keys, and interact with external wallet and relay infrastructure.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description frames the skill as simple identity/wallet bootstrap, but the documented behavior extends to ongoing social actions, DM handling, relay management, zap/payment flows, and autoresponse state management. That mismatch is dangerous because users may grant trust for one-time setup while unknowingly enabling broader persistent messaging, financial, and surveillance-like capabilities across third-party services.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The README makes a strong security assurance that the agent 'never displays or transmits private keys,' but the documented setup explicitly requires the user to open a local config file and recover the mnemonic from it. That is a contradictory and misleading security claim around highly sensitive credential material, which can cause unsafe handling assumptions and increase the chance of key compromise.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The README claims the skill does not read local files, yet it also states that profile data is pulled from local files such as SOUL.md and integrates with other local markdown files. This is a misleading capability statement that can cause users to underestimate the skill's local data access and grant trust under false assumptions.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill includes pending-mentions, mark-responded/ignored, rate limiting, and local state tracking that support semi-autonomous response workflows beyond basic identity setup. This increases risk by enabling ongoing behavioral automation and social interaction tracking that may act on external content over time without narrow user intent for each action.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Heartbeat integration instructs periodic checking of mentions and DMs, turning a setup skill into continuous monitoring of external communications. In context, this broadens exposure to unsolicited content and enables persistent surveillance-style behavior that exceeds a one-time onboarding flow.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The command examples and trigger phrasing are broad enough to overlap with normal conversation, making accidental activation more likely. In a skill that can post publicly, send DMs, and initiate payment-related workflows, ambiguous activation can lead to unintended outbound actions or financial operations.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The user phrase-to-action table maps everyday language directly to network and wallet actions without clear scoping or confirmation boundaries. This is risky because ordinary conversational text could be interpreted as commands that publish content, contact others, or create invoices/payments.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The installer performs `npm install --quiet` and suppresses stderr, which hides what code is being fetched and executed during setup. Because npm dependency installation can trigger lifecycle scripts and pull transitive packages from the network, silent execution reduces user awareness and makes supply-chain compromise or unexpected behavior harder to detect; in this skill's context, that is more concerning because the skill manages identity and wallet-related components.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The script automatically reads a wallet mnemonic from ~/.cocod/config.json and derives a Nostr private key from it, coupling wallet recovery material to social identity without an explicit consent or risk warning at the decision point. Because a single mnemonic may back both funds access and identity, silent reuse materially increases blast radius if the mnemonic is exposed, mishandled, or unexpectedly imported.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The delete command immediately signs and publishes a deletion event for the supplied note reference with no confirmation, preview, or ownership sanity check. In an agent or scripted environment, malformed inputs or prompt-driven misuse can cause irreversible public actions and operational loss without any user checkpoint.

External Transmission

Medium

Category: Data Exfiltration
Content: |---------|-------| | Mint | `https://mint.minibits.cash/Bitcoin` | | Lightning domain | `@npubx.cash` | | Avatar fallback | `https://api.dicebear.com/7.x/shapes/png?seed=<npub>` | | Nostr key | `~/.nostr/secret.key` | | Wallet data | `~/.cocod/` |
Confidence: 81% confidence
Finding: https://api.dicebear.com/

Session Persistence

Medium

Category: Rogue Agent
Content: ### Step 1: Secure Setup (User Consent Required) **SECURITY NOTICE:** This skill will create cryptographic keys for your agent. This requires: - Creating Nostr identity keypair in `~/.nostr/secret.key` - Creating Cashu wallet with backup seed in `~/.cocod/config.json` - User must explicitly backup the mnemonic seed phrase
Confidence: 87% confidence
Finding: create cryptographic keys for your agent. This requires: - Creating Nostr identity keypair in `~/.nostr/secret.key` - Creating Cashu wallet with backup seed in `~/.cocod/config.json` - User must expli

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 99% confidence
Finding: ws==8.18.0

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/nostr.js:81