vibe-coded a tool to test your air-gapped wallet ( SeedSigner (nprofile…u2rf) , Specter DIY (nprofile…j87h) ) against basic #DarkSkippy attempts: create fake PSBTs with a fake seed, and see if the HW wallet returns the expected signature and does not try to leak data:
https://niot.space/exfil-tester.html
Obviously you should also verify the firmware's pgp, and this tool does not cover sophisticated #DarkSkippy attacks (i.e. that try to leak data only in certain conditions, like in transactions of specific amounts, or multisig setups).
Thanks to Frostsnap (nprofile…gtmd) for building darkskippy.com and creating a real-world example.
Oren ☂️ 🎲 / Oren ☂️ #BIP-128
npub1xv…5m7f8
2026-08-08 11:09:45 UTC
Author Public Key
npub1xvtw9ky0ly0ppzw8tlhdek965gjck329tga326hkzlt7c7d5tljs85m7f8Published at
2026-08-08 11:09:45 UTCEvent JSON
{
"id": "c098c99102a4f98fc267796254d6346d4a48dcc271d54d17ccbb7c622c71614a",
"pubkey": "3316e2d88ff91e1089c75feedcd8baa2258b45455a3b156af617d7ec79b45fe5",
"created_at": 1786187385,
"kind": 1,
"tags": [
[
"p",
"f2c96c97f6419a538f84cf3fa72e2194605e1848096e6e5170cce5b76799d400",
"wss://eden.nostr.land/"
],
[
"p",
"93dbb6d68b35847655b9c76ab8bb48467c307db93af1e5b1c472ce07ea74c840",
"wss://relay.damnus.io/"
],
[
"p",
"48df05911479878016f0579d6dd6366d357d4c75ffe7eaeb717d589375a04767",
"wss://nostrelites.org/"
],
[
"t",
"DarkSkippy"
],
[
"t",
"darkskippy"
],
[
"r",
"https://niot.space/exfil-tester.html"
],
[
"client",
"Amethyst"
]
],
"content": "vibe-coded a tool to test your air-gapped wallet ( nostr:nprofile1qqs09jtvjlmyrxjn37zv70a89csegcz7rpyqjmnw29cveedhv7vagqqpzemhxue69uhk2er9dchxummnw3ezumrpdejz7qg4waehxw309aex2mrp0yhxgctdw4eju6t09uq3zamnwvaz7tmwdaehgu3wwa5kuef0x9u2rf , nostr:nprofile1qqsf8kak669ntprk2kuuw64chdyyvlps0kun4u09k8z89ns8af6vssqpzemhxue69uhhyetvv9ujuerpd4h82uewd9hj7qgawaehxw309ahx7um5wghxy6t5vdhkjmn9wgh8xmmrd9skctcpzamhxue69uhhyetvv9ujumn0wd68ytnzv9hxgtcy5j87h ) against basic #DarkSkippy attempts: create fake PSBTs with a fake seed, and see if the HW wallet returns the expected signature and does not try to leak data:\n\nhttps://niot.space/exfil-tester.html\n\nObviously you should also verify the firmware's pgp, and this tool does not cover sophisticated #DarkSkippy attacks (i.e. that try to leak data only in certain conditions, like in transactions of specific amounts, or multisig setups).\n\nThanks to nostr:nprofile1qqsy3hc9jy28npuqzmc908td6cmx6dtaf36llel2adch6kynwksywecpzemhxue69uhkummnw3ex2mrfw3jhxtn0wfnj7qg4waehxw309ahx7um5wghxgmr9wghxxmmd9uq3samnwvaz7tmswf5k6atn9ehx7um5wgcjucm0d5hs2ugtmd for building darkskippy.com and creating a real-world example.",
"sig": "1b12b523adde22889c93cf6c18402ab3f13b127e6c45a36f45ab3da517e65c6a169953ba50add79d6730aae9d9ca98b06cdfdc252cd284a445898a1cb546ca1e"
}