using-nostr
Fail
Audited by Snyk on Mar 1, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.90). The skill repeatedly shows and expects passing nsec private keys directly in function calls and examples (e.g., nsec: "nsec1...your-private-key") which encourages embedding user secrets verbatim in generated code/commands and therefore creates an exfiltration risk despite mentioning env var best practices.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill explicitly connects to public Nostr relays (e.g., the default relays like wss://relay.damus.io listed in SKILL.md) and uses get_global_feed and receive_messages/getMessageNIP17 to fetch and process public, user-generated posts and DMs that the agent is expected to read and could materially influence subsequent actions.
Audit Metadata