nostrsocial

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:05 AM UTC
• Version: 0.1.3

Overview

The skill is mostly coherent for managing Nostr-based social contacts, but its setup example exposes a root device secret in terminal output.

Review this before installing if you will use real Nostr identities or contacts. Do not run the first-run example as written; avoid printing the exported device secret, store it only in a secure secret manager or encrypted backup, and prefer a pinned, reviewed package version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:32-35
Vulnerability Type: Supply-chain exposure through an unpinned dependency
Risk Level: Medium

Vulnerable Code

markdown

## Install

```bash
pip install nostrsocial

text

### Technical Analysis

The installation command retrieves the `nostrsocial` package without specifying an exact version or verifying an integrity hash. The package implementation is not included in the audited project, so its installation and runtime behavior cannot be verified from the supplied files.

Because package resolution occurs when the command is executed, the installed content can differ from the version available when this Skill was reviewed. A compromised package release, distribution account, package index, build dependency, or source distribution build process could introduce attacker-controlled code. The unpinned declaration in `metadata.json` also corroborates that no exact version is enforced.

### Attack Path

1. An attacker compromises the `nostrsocial` distribution account, package release process, build dependency, or relevant package-index delivery path.
2. The attacker publishes a malicious release under the expected package name.
3. An operator follows the documented `pip install nostrsocial` instruction.
4. The package manager resolves and installs the attacker-controlled release.
5. Malicious code can run during an unsafe source-build process or when the installed package is subsequently imported and used.
6. The code operates with the permissions of the installation or application process and can access data available to that process.

### Impact Assessment

Successful exploitation could permit arbitrary code execution in the installation or application context. Depending on the invoking process, accessible assets may include local contact data, identity files, application files, and sensitive environment variables such as `NOSTR_NSEC` or `NOSTRKE
...[truncated 196 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to an explicitly reviewed version, such as nostrsocial==0.1.3.
• Record cryptographic hashes and install with hash verification, for example through a requirements file and pip install --require-hashes.
• Commit a reproducible lock file that pins direct and transitive dependencies.
• Prefer reviewed binary wheels from a trusted source and disable unexpected source builds where practical.
• Audit both nostrsocial and its nostrkey dependency before deployment.
• Run installation and application execution under a dedicated, least-privileged account without unnecessary access to identity credentials.
• Ensure the version constraints in SKILL.md, package metadata, and deployment configuration are consistent.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:54

Finding

Cryptographic Device Secret Exposed Through Standard Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:54-61
Vulnerability Type: Plaintext disclosure of sensitive cryptographic material
Risk Level: High

Vulnerable Code

python

from nostrsocial import SocialEnclave

# Create the entity's social awareness
enclave = SocialEnclave.create()

# CRITICAL: back up the device secret immediately.
# This secret is the root of all proxy npub derivation.
# If you lose it, the entity's relationship map becomes unrecoverable.
secret = enclave.export_secret()
print(f"Back up this secret securely: {secret}")

Technical Analysis

The documented first-run procedure exports the device secret and interpolates it directly into a standard-output message. The documentation identifies this value as the root of all proxy npub derivation, making it sensitive cryptographic material.

Standard output is not a secure secret-transfer mechanism. Output may be retained in terminal capture buffers, CI/CD logs, agent transcripts, container logs, remote execution records, observability systems, or support bundles. Access controls and retention policies for those systems are often substantially weaker than those applied to a secret manager.

The warning text does not prevent disclosure because the secret itself is included in the same output record.

Attack Path

1. An operator copies or executes the documented first-run example.
2. export_secret() returns the device secret.
3. The formatted print call writes the complete secret to standard output.
4. A terminal recorder, log collector, CI system, container runtime, agent transcript, or another process captures the output.
5. An attacker or unauthorized user gains read access to the retained output.
6. The attacker obtains the root secret and may derive or correlate proxy identities associated with the relationship map, subject to the behavior of the external library.

Impact Assessment

Exposure compromi ...[truncated 592 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the print statement and never place the device secret in standard output, logs, exception messages, or agent transcripts.
• Provide a dedicated secure-export API that writes directly to an operator-selected secret manager, encrypted vault, or protected file descriptor.
• If file export is necessary, create the file atomically with owner-only permissions such as 0600, encrypt it before persistence, and avoid predictable temporary files.
• Require explicit operator confirmation before export and display only a success message or non-sensitive fingerprint.
• Document secure backup and recovery procedures without rendering the secret in examples.
• Add automated tests or logging filters that detect and reject accidental output of exported secrets.
• Treat any secret previously exposed through captured output as compromised; rotate or regenerate it where supported and remove retained copies from logging systems.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

These setup instructions expose a root secret via console output and describe it as the basis for all proxy npub derivation. If an attacker obtains this secret from logs or operator terminals, they may be able to reconstruct or impersonate the enclave's social identity mappings, undermining confidentiality and trust across all derived identities.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

python

from nostrsocial import SocialEnclave

# Create the entity's social awareness
enclave = SocialEnclave.create()

# CRITICAL: back up the device secret immediately.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation explicitly prints the enclave's root device secret to stdout during setup. Secrets sent to terminal output are commonly captured by shell history tools, terminal scrollback, screen recording, remote session logs, notebook outputs, or centralized logging, making compromise of the social identity root materially more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.