Nostr Social

### Overall **Strong, feature-complete Nostr + ecash integration for agents, best for technically capable users who understand key management and Lightning.** It turns an OpenClaw agent into a first-class Nostr citizen with its own identity, wallet, and social behavior. ### What it does well - **End-to-end bootstrap:** Installs dependencies, creates a Cashu wallet, derives a Nostr keypair (NIP-06) from the mnemonic, configures profile, and posts the first note. - **Broad Nostr coverage:** Posts, replies, reactions, reposts, bookmarks, follows/mutes, relays, DMs, mentions, WoT-based autoresponse hooks. - **Wallet + Lightning:** Creates a Cashu wallet, exposes balance, invoice creation, invoice payment, and zaps via cocod and a Lightning address. - **Agent integration:** Pulls name/about from SOUL.md/IDENTITY.md, sets avatar/banner (or deterministic DiceBear fallbacks), and plugs into heartbeat checks for mentions/DMs. - **Security-aware implementation details:** - Explicit security notice and **user consent** before key generation and wallet setup. - Mnemonic stored in `~/.cocod/config.json` and **never printed or transmitted** by the agent. - Uses **stdin** for user-provided content to mitigate shell injection risk. - Autoresponse includes a rate limiter to avoid spammy behavior. ### Key risks & limitations - **Financial and identity risk:** - The agent can control an ecash wallet and pay Lightning invoices (including zaps). Misconfiguration, prompt hijacking, or malicious instructions could cause **unauthorized spending**. - The same mnemonic controls both the Nostr identity and the wallet. Compromise of `~/.cocod/config.json` or the host system could lose funds and identity. - **No enforced spending limits or per-transaction confirmations:** The flows described do not impose hard caps or mandatory human confirmation for `cocod send`/zap operations; this should be considered when deciding how much value to store. - **Dependency and environment sensitivity:** Relies on `node`, `npx cocod`, and `nostr.js` scripts plus external mints/relays. Failures or network issues can degrade functionality; there’s no robust retry/health-check story described. - **Not beginner-friendly for non-crypto users:** Users must understand seed phrase backups, local file paths, and the implications of self-custody and decentralized identity. ### Recommended scenarios - You **already use Nostr/Bitcoin/Lightning** and want your agent to have a real, persistent identity and wallet there. - You’re building **social or community agents** that interact publicly, follow your npub, and respond to mentions/DMs within a Web-of-Trust. - You want to **experiment with autonomous or semi-autonomous social bots** that can both converse and handle small-value zaps/tips. ### Use with caution if - You’re not comfortable with **seed phrase management** and local file security. - You plan to hold **more than trivial amounts** of value in the agent’s wallet; consider separate, low-value wallets and strict operational policies. - You cannot ensure a reasonably **secure environment** (filesystem, host OS, and agent governance) for keys and wallet data.