nansen-dca-tracker

Pass

Audited by Gen Agent Trust Hub on Apr 23, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the nansen-cli package, a command-line tool for interacting with the Nansen crypto-analytics service, to be installed via the official npm registry.
  • [DATA_EXFILTRATION]: The skill requires a NANSEN_API_KEY. It correctly instructs the user to set this as an environment variable rather than hardcoding it, which is the standard safe practice for CLI tools.
  • [COMMAND_EXECUTION]: The skill's environment is secured using the allowed-tools directive, which restricts bash execution specifically to the nansen binary. This prevents attackers from using the shell to execute unauthorized system commands or exfiltrate data.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface for external data from the Nansen API.
  • Ingestion points: Data from nansen research command outputs is processed by the agent.
  • Boundary markers: No explicit markers are defined in the prompt instructions.
  • Capability inventory: Execution is strictly limited to the nansen command-line interface.
  • Sanitization: The agent processes raw output from the verified research tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 23, 2026, 10:47 PM
Security Audit — agent-trust-hub — nansen-dca-tracker