nansen-smart-money-alpha
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's metadata specifies the installation of the
nansen-clipackage from the public npm registry. This package is the official tool maintained by the skill author (nansen-ai). - [COMMAND_EXECUTION]: The instructions direct the agent to use the
nansencommand-line utility via Bash to fetch token screening data, netflow statistics, and flow intelligence. These operations are restricted to thenansennamespace as defined in theallowed-toolssection. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources (the Nansen API) to provide alpha discovery insights. While this creates a theoretical surface for indirect injection via malicious data in the API response, it is a standard characteristic of tools designed for data retrieval.
- Ingestion points: CLI output from
nansen researchcommands. - Boundary markers: No specific delimiters are used to wrap the tool output in the prompt.
- Capability inventory: Execution of Bash commands using the
nansentoolset. - Sanitization: The skill relies on the Nansen CLI's internal handling of API data.
Audit Metadata