Skills
skills/askeluv/nansen-cli/nansen-wallet-keychain-migration/Gen Agent Trust Hub

nansen-wallet-keychain-migration

Fail

Audited by Gen Agent Trust Hub on Mar 28, 2026

Risk Level: HIGHCREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [CREDENTIALS_UNSAFE]: The verification step involves running nansen wallet export default, which outputs unencrypted private keys into the agent's context and shell history.\n- [CREDENTIALS_UNSAFE]: The skill targets sensitive local files for reading, specifically ~/.nansen/.env and .credentials, which are used to store plaintext passwords.\n- [COMMAND_EXECUTION]: The skill uses source ~/.nansen/.env during migration. This command executes the file's content in the shell session, allowing for arbitrary command injection if the file contains malicious shell code.\n- [EXTERNAL_DOWNLOADS]: The skill installs the nansen-cli Node.js package without a pinned version, which poses a supply chain risk as the agent will pull the latest version from the registry at runtime.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Mar 28, 2026, 09:15 PM