nansen-wallet-manager
Warn
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
nansen-clipackage from the Node.js registry (NPM) to provide the necessary binary for wallet operations. - [CREDENTIALS_UNSAFE]: The instructions reveal an insecure fallback mechanism where wallet passwords may be stored in plaintext at
~/.nansen/wallets/.credentialsif a secure OS keychain is not available. It also requires the management of sensitive environment variables includingNANSEN_API_KEY,PRIVY_APP_SECRET, andNANSEN_WALLET_PASSWORD. - [DATA_EXFILTRATION]: The
nansen wallet export --revealcommand prints private keys directly to stdout. In an agent context, this sensitive information is captured in the conversation transcript, exposing it to any system or user with access to the chat logs. The--fileflag similarly allows writing private keys to arbitrary paths on the local filesystem. - [COMMAND_EXECUTION]: The skill enables the execution of powerful financial commands via the
nansenCLI, includingnansen wallet sendfor transferring native tokens across different blockchain networks.
Audit Metadata