Security audit
Nostr
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed Nostr direct-message channel plugin that uses a configured Nostr key and relays for its stated messaging purpose.
Use a dedicated bot Nostr key, keep the private key in an environment variable or secret store, configure trusted relays, and prefer pairing or allowlist mode unless you intentionally want anyone on Nostr to message the bot.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.