nansen-token-transfer-analysis
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
nansen-cliNode.js package as part of its setup. This package is an official tool provided by the skill author (nansen-ai) to interact with their blockchain data services. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data retrieved from blockchain APIs. While this represents a theoretical ingestion surface for instructions embedded in data (e.g., token metadata or wallet labels), the risk is mitigated by the structured nature of the CLI output and standard agent guardrails.
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to executenansenCLI commands. These operations are scoped to the intended functionality of querying token movement and do not include arbitrary command execution or system modification patterns.
Audit Metadata