nansen-wallet-profiler
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill specifies the installation of 'nansen-cli' via a Node.js package manager. This is a legitimate vendor resource provided by 'nansen-ai' for its blockchain analytics platform.
- [COMMAND_EXECUTION]: The skill uses a restricted toolset 'Bash(nansen:*)' to execute specific research and authentication commands. These commands are scoped to the 'nansen' binary and are used for their intended purpose of blockchain data retrieval.
- [CREDENTIALS_UNSAFE]: The documentation references the use of 'NANSEN_API_KEY' as an environment variable and 'nansen login' for authentication. No hardcoded secrets or sensitive credentials are included in the skill source; it follows standard practices for CLI authentication and secret management via environment variables.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data such as wallet addresses and search queries which are then passed as arguments to the CLI tool. While it lacks explicit sanitization instructions for the agent, the structure of the CLI commands acts as a natural boundary, and the risk of injection affecting the underlying analytics tool is minimal.
- Ingestion points: Command arguments such as '--address', '--query', and '--addresses' in 'SKILL.md'.
- Boundary markers: None explicitly defined.
- Capability inventory: 'Bash(nansen:*)' for data retrieval.
- Sanitization: Not explicitly mentioned; relies on the CLI's internal argument parsing.
Audit Metadata