nansen-wallet-manager

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill prompt instructs the agent to ask the user for a wallet password and then pass it directly into a command using an environment variable (NANSEN_WALLET_PASSWORD="<password_from_user>"), which puts sensitive user-provided secrets into the agent's context and execution commands.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documentation describes tools specifically designed for crypto wallet management, including sending native tokens (SOL, ETH) via blockchain commands (nansen wallet send), which explicitly represents Direct Financial Execution Authority (Crypto/Blockchain transactions).