Security audit

nostrwalletconnect

Security checks for vulnerabilities and agentic risk

Overview

This skill is clearly a Lightning wallet integration, but it can move real funds and its payment examples and install path do not provide enough safeguards for that authority.

Review before installing. Use only a scoped, revocable NWC connection with low balances, wallet-side spending limits, and only the NIP-47 methods needed. Do not let an agent pay invoices autonomously; require explicit user approval for the exact invoice, amount, recipient/context, and purpose. Store NWC_CONNECTION_STRING only as a secret, never in source code or logs, and consider pinning dependencies before production use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

Location: SKILL.md:6
Finding: Unpinned Third-Party Dependency Handles Wallet Credentials and Payment Operations
Content: View full analysis
=3.10" }, "dependencies": [ "nostrkey>=0.1.1" ] ``` The external package is then trusted with wallet credentials and payment operations: ```python from nostrwalletconnect import NWCClient NWC_URI = "nostr+walletconnect://?relay=wss://relay.example.com&secret=" async def main(): async with NWCClient(NWC_URI) as nwc: result = await nwc.pay_invoice("lnbc10u1p...") print(f"Payment successful! Preimage: {result.preimage}") ``` ### Technical Analysis The project installs `nostrwalletconnect` without an exact version or cryptographic hash. Its declared `nostrkey>=0.1.1` dependency also accepts any compatible later release. Neither dependency's implementation is included in the audited project. Consequently, the code installed in a future environment may differ from the code that existed when this skill was reviewed. This is particularly security-sensitive because `NWCClient` receives an NWC connection URI containing a secret authorization key, opens external relay connections, reads wallet information, and can submit irreversible Lightning payment requests. This ...[truncated 1982 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example triggers a real Lightning payment directly with pay_invoice(...) and provides no confirmation, approval gate, amount validation, or safety warning. In an agent skill whose purpose is financial transactions, this is especially dangerous because integrators may copy the example into autonomous workflows, enabling unintended or attacker-influenced spending.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill grants a broad financial capability but does not define clear activation boundaries, approved use cases, or constraints on when payment-related actions may be invoked. In an agent setting, vague scope around a money-moving skill increases the chance of unauthorized, socially engineered, or policy-bypassing payment attempts because the model may treat any payment-related request as in-scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill shows how to execute pay_invoice but does not place a strong, explicit warning at the point of use that Lightning payments move real funds and are typically irreversible. Because this is a financial skill, omission of a confirmation requirement materially raises the risk of accidental or manipulated payments, especially if an agent is induced to process attacker-supplied invoices.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The example hardcodes a Nostr Wallet Connect URI containing a wallet pubkey and secret directly in source code. Even though placeholders are shown, this pattern encourages developers to embed real wallet credentials in code, which can be leaked through source control, logs, screenshots, or copied examples and would allow unauthorized wallet access such as creating invoices, querying balance, or initiating payments depending on wallet permissions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest advertises the ability to pay Lightning invoices and manage wallet state, but it does not prominently warn users that granting this skill access can authorize real financial transactions. In an agent setting, unclear disclosure around payment authority and secret handling increases the risk of accidental fund loss, over-broad permissioning, or unsafe deployment with production wallet credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented NWC connection string is explicitly described as containing a secret key, yet the metadata provides no accompanying warning that disclosure of this value could grant unauthorized wallet access. Because this skill is payment-capable, leakage through logs, prompts, screenshots, or misconfigured secret storage could directly enable theft or unauthorized payment requests.
Content: No source excerpt is available for this finding.