nostr-dogechat

Bridge to the DogeChat Nostr geohash chat network.

This skill appears to implement a Nostr/DogeChat bridge but has several mismatches and privacy-relevant behavior you should understand before installing: - It will generate a private signing key and store it unencrypted at ~/.openclaw/nostr-dogechat/identity.json (rotated after 24h). If you don't want a plaintext secret stored on your machine, do not install/run it as-is. Consider moving storage to a secure keystore or encrypting the file. - SKILL.md says the geohash comes from USER_CONTEXT, but the code reads CLI args; the packaging is inconsistent and the repo omits an install step. Expect to manually install Node and the npm deps (and note package.json is missing 'minimist'). - The skill will open outbound WebSocket connections to public relays (wss://relay.damus.io, wss://nos.lol, wss://relay.dogechat.org) and publish signed events under the generated identity. If you are concerned about network traffic or linking messages to a persistent identity, do not run it until you review/modify the code. Recommendations: inspect and run the code in an isolated environment (or sandbox/VM), add encryption for the identity file or use a dedicated ephemeral identity, update package.json to declare all deps and provide an install step, and confirm you are comfortable with the relay endpoints before enabling autonomous agent invocation.

Type: OpenClaw Skill Name: nostr-dogechat Version: 1.0.0 The skill provides a bridge to the Nostr-based DogeChat network by generating an ephemeral local identity (private key) stored in `~/.openclaw/nostr-dogechat/identity.json`. The `dogechat-bridge.js` script handles standard Nostr event signing and publishing to public relays (e.g., wss://relay.damus.io) without any evidence of data exfiltration, credential theft, or malicious execution. While `minimist` is missing from the `package.json` dependencies, the overall logic is transparent and aligned with the stated purpose.