nansen-smart-alerts
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [SAFE]: The skill's instructions and operations (list, create, update, toggle, delete) are entirely consistent with its stated purpose of managing blockchain smart alerts.
- [EXTERNAL_DOWNLOADS]: The skill installs the
nansen-clipackage from the Node.js package registry (npm). This package provides thenansenbinary required for the skill's operations and is a legitimate resource for the skill's author (nansen-ai). - [COMMAND_EXECUTION]: The skill restricts the agent's command-line access to the
nansenbinary usingBash(nansen:*). This implementation follows the principle of least privilege by preventing arbitrary shell command execution. - [DATA_EXFILTRATION]: The tool supports alert notifications via Telegram, Slack, Discord, and custom webhooks. These are primary features of the service and rely on user-supplied destination parameters (chat IDs and webhook URLs) rather than hardcoded external destinations.
- [CREDENTIALS_UNSAFE]: The skill correctly manages authentication through the
NANSEN_API_KEYenvironment variable via theprimaryEnvconfiguration, avoiding the storage or leakage of hardcoded credentials.
Audit Metadata