nostrsocial

Social awareness for AI entities — contacts, trust tiers, and identity verification over Nostr

This skill appears to do what it claims, but take these precautions before installing: - Verify the package source: confirm the nostrsocial pip package matches the referenced GitHub repo (review the repository and recent releases) and that the package on PyPI (or your install source) is the legitimate project. - Resolve the install-method inconsistency: SKILL.md mentions an 'uv' install kind while metadata.json and the README show pip; prefer installing via pip only after verifying the package origin. - Never export or print private keys in production: the example calls export_secret() and prints it — treat that as a one-time secure backup flow only (copy into secure vault, do not stdout/log). Prefer using the NostrKey skill and encrypted storage rather than environment-binding NOSTR_NSEC. - Review network behavior in the package source: the skill will interact with Nostr relays (NOSTR_RELAY). Inspect the code for any unexpected network endpoints or telemetry before granting access. - Principle of least privilege: Keep NOSTR_NSEC and NOSTRKEY_PASSPHRASE protected (do not hardcode). If possible, use a secure secret manager and the suggested NostrKey skill for key handling. If you want higher confidence, request the package's PyPI URL and a link to the repository commit/tarball used for this release so you (or a reviewer) can inspect the published package contents and network calls.

Type: OpenClaw Skill Name: nostrsocial Version: 0.1.3 The nostrsocial skill provides a framework for AI agents to manage social relationships and trust tiers using the Nostr protocol. It implements contact management, identity verification, and behavioral rules (e.g., token budgets and warmth) based on relationship depth. While it handles sensitive cryptographic keys (NOSTR_NSEC), the documentation in SKILL.md and metadata.json includes explicit warnings against exposure and follows a logical, documented purpose without evidence of malicious intent, exfiltration, or unauthorized execution.