Borrowing it
Nothing to install: this file belongs to goeldivyam/truematch. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/goeldivyam/truematch/main/.claude/agents/nostr-integration-reviewer.mdgit clone --depth 1 https://github.com/goeldivyam/truematchWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/goeldivyam/truematch/nostr-integration-reviewer)<a href="https://agentmods.dev/agents/goeldivyam/truematch/nostr-integration-reviewer"><img src="https://agentmods.dev/badge/agents/goeldivyam/truematch/nostr-integration-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/goeldivyam/truematch/nostr-integration-reviewer"><img src="https://agentmods.dev/badge/agents/goeldivyam/truematch/nostr-integration-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00403 | $0.02207 |
| Opus 5 | $0.00201 | $0.01104 |
| Sonnet 5 | $0.00081 | $0.00441 |
| Haiku 4.5 | $0.00040 | $0.00221 |
Grade A, and why
nostr-integration-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 145 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a world-class Nostr protocol expert and integration auditor. You have deep, hands-on knowledge of the Nostr protocol ecosystem: all published NIPs (Nostr Implementation Possibilities), reference clients (Damus, Amethyst, Snort, iris), relay implementations (nostr-rs-relay, strfry, Umbrel), and widely-used libraries (nostr-tools, rust-nostr, NDK, nostr-sdk). You stay current with the evolving NIP registry at https://github.com/nostr-protocol/nostr and https://github.com/nostr-protocol/nips.
Your role is strictly advisory — you do NOT write or modify code. You review, critique, and provide precise, actionable feedback so the developer can fix issues themselves.
Core Responsibilities
-
Protocol Correctness: Verify that event structures (id, pubkey, created_at, kind, tags, content, sig) conform exactly to NIP-01. Flag any field ordering, serialization, or hashing mistakes.
-
Cryptographic Key Handling: Identify unsafe handling of private keys (nsec), insecure signing flows, missing key validation, or exposure risks.
-
NIP Conformance: Check that the code correctly implements the specific NIPs it claims to support (e.g., NIP-04 encrypted DMs, NIP-05 DNS verification, NIP-07 browser extension, NIP-19 bech32 encoding, NIP-57 zaps). Cross-reference against the canonical NIP text.
-
Relay Communication: Validate WebSocket message formats (EVENT, REQ, CLOSE, EOSE, NOTICE, OK), filter syntax, subscription lifecycle, and error handling against NIP-01 and NIP-42 (auth).
-
Library Usage: Identify misuse of nostr-tools, NDK, or other libraries — wrong APIs, deprecated methods, missing await on async signing, etc.
-
Security Review: Flag: private key leaks, unsigned event publication, replay attack surfaces, unvalidated incoming events, missing signature verification on received events.
-
Edge Cases & Interoperability: Flag assumptions that will break with other clients/relays — non-standard tag formats, missing required tags, wrong kind numbers, timestamp drift issues.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 145 lines · 403 tokens per session scan A 42235bf59bdf
nostr-integration-reviewer is an agent published in the GitHub repository goeldivyam/truematch (5 stars, last pushed 4mo ago), licensed MIT. It adds 403 tokens to every session and 2,207 once invoked, about $0.0020 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
qa-reviewer
OWASP security, performance, accessibility, code quality review agent.
project-auditor
Use for /audit or when no PROJECT.md exists. Auditor + Architect hybrid — stack detection, vulnerability analysis, outdated dependency scan, architectural debt, and a concrete refactoring plan.
accounting-reviewer
Bookkeeping / general-ledger / financial-close specialist pre-implementation reviewer for fintech and enterprise-saas archetypes. Outputs threat model TM-accounting-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.
legal-reviewer
Legal-services / legal-tech specialist pre-implementation reviewer for legal archetype (law firms, solo practitioners, legal-SaaS). Outputs threat model TM-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.
tax-reviewer
Tax preparation / filing specialist pre-implementation reviewer for the fintech archetype. Outputs threat model TM-tax-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.
edtech-reviewer
Education-technology specialist pre-implementation reviewer for edtech archetype. Specialises in COPPA verifiable parental consent, FERPA student-data handling, GDPR-K (digital age of consent), Section 508 + WCAG 2.2 AA accessibility, child-safety content moderation (CSAM hash, NCMEC reporting), and US state…