A supermarket of malicious code. Good luck.

I installed it. I like it. I wouldn't let it near any private information or write access to any of my accounts. And I feel no urge to upgrade it so far but given it lives on an isolated box with so far one api key to read-only public repos, upgrading it should be low risk, too.

Well thought approach. I cloned it, run through Goose agent with security test and the results are disqualifying for running it with access to user data, network and credentials - all that I can see on Nostr. I want to understand how it works but I’d rather vibe code it frim scratch then use it as it is now.