nansen-smart-money-alpha

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill's metadata specifies the installation of the nansen-cli package from the public npm registry. This package is the official tool maintained by the skill author (nansen-ai).
  • [COMMAND_EXECUTION]: The instructions direct the agent to use the nansen command-line utility via Bash to fetch token screening data, netflow statistics, and flow intelligence. These operations are restricted to the nansen namespace as defined in the allowed-tools section.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources (the Nansen API) to provide alpha discovery insights. While this creates a theoretical surface for indirect injection via malicious data in the API response, it is a standard characteristic of tools designed for data retrieval.
  • Ingestion points: CLI output from nansen research commands.
  • Boundary markers: No specific delimiters are used to wrap the tool output in the prompt.
  • Capability inventory: Execution of Bash commands using the nansen toolset.
  • Sanitization: The skill relies on the Nansen CLI's internal handling of API data.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 11:10 PM