nostr-profile

Nostr profile management for AI agents — publish, read, and update kind 0 metadata on any relay

This skill appears to do what it claims (publish/read/update Nostr profiles) but there are mismatches you should resolve before installing: - Expect to provide sensitive signing material. The skill needs either a passphrase to decrypt a local identity file (NOSTRKEY_PASSPHRASE) or a raw private key (NOSTR_NSEC) to sign events. Do not set NOSTR_NSEC in shared or untrusted environments; prefer an encrypted identity file and passphrase when possible. - Confirm which environment variables the agent platform will expose to the skill (SKILL metadata, registry metadata.json, and examples disagree). Make sure required sensitive env vars are declared and you explicitly consent to providing them. - Verify the install method and package source. metadata.json and SKILL.md reference pip install of 'nostr-profile' but the registry 'install' list also contains an unfamiliar 'uv' installer. Inspect the pip package and the GitHub repo (linked in metadata.json) before installing; review the package code (nostr_profile and its dependency nostrkey) to ensure it only signs and sends properly formed Nostr events and does not exfiltrate secrets. - Be aware the skill will publish public profile data to third-party relays and uses external image services (DiceBear). Published data is public and discoverable. If you do not want public exposure of a name/bio/avatar tied to your private key, do not publish. If you want to proceed: install in an isolated environment, audit the installed package code, and prefer using an encrypted identity file + passphrase rather than exposing raw private keys in environment variables.

Type: OpenClaw Skill Name: nostr-profile Version: 0.2.0 The nostr-profile skill is a legitimate utility for managing Nostr identities (Kind 0 metadata) on the Nostr network. It utilizes the 'nostr-profile' and 'nostrkey' libraries to publish, read, and update profile information such as names, bios, and avatars. The SKILL.md instructions include appropriate security guidance, explicitly directing the agent to never log private keys (nsec) and to inform users that profile data is public. The code and examples (e.g., examples/publish_profile.py) align with the stated purpose without any signs of malicious intent or unauthorized data exfiltration.