nostrkey

Cryptographic identity SDK for AI agents — generate Nostr keypairs, sign events, encrypt messages, BIP-39 seed phrases, portable backup tokens. 69 tests, zer...

This skill appears to be a legitimate Nostr identity SDK, but take these precautions before installing or enabling it: - Confirm the install behavior: will the agent automatically pip install the 'nostrkey' package? If so, verify the package source (PyPI project page and GitHub repo) and consider pinning a known-good version or reviewing the package code before installing. - Protect secrets: provide NOSTRKEY_PASSPHRASE via a secure secret mechanism (not in chat). The skill will print the raw seed phrase and asks the operator to paste seed phrases for restore — never paste seed phrases or private keys into an untrusted chat or log. - Resolve metadata inconsistencies: the registry summary claimed no env vars/no install spec while SKILL.md and metadata.json require NOSTRKEY_PASSPHRASE and list a pip install. Ask the publisher to correct the manifest so you know whether remote code will be fetched. - Review example code: examples show saving identity files to disk and publishing to relays (wss://relay.damus.io). Confirm you are comfortable with the agent having a persistent public identity and with events being published to chosen relays. If you cannot verify the pip package source or are uncomfortable with printing/pasting seed phrases, treat this skill as untrusted and do not install or enable it.

Type: OpenClaw Skill Name: nostrkey Version: 0.3.0 The skill provides a legitimate cryptographic identity framework for AI agents using the Nostr protocol. It includes detailed instructions in SKILL.md for the agent to securely manage keypairs, including generating new identities, restoring from seed phrases, and using passphrases for encryption at rest. The bundle features security-conscious guidelines that instruct the agent to never log private keys and to warn users about deleting sensitive messages from chat history. No evidence of data exfiltration, malicious execution, or unauthorized access was found; the functionality is entirely aligned with the stated purpose of identity management.