nansen-wallet-migration
Pass
Audited by Gen Agent Trust Hub on Mar 6, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXFILTRATION]: The skill reads from sensitive file paths including ~/.nansen/.env and ~/.nansen/wallets/.credentials which contain plaintext or reversible wallet passwords.
- [DATA_EXFILTRATION]: The migration verification step executes nansen wallet export default which outputs raw private keys to the terminal. In an AI agent environment, this results in highly sensitive cryptographic material entering the conversation history and process logs.
- [COMMAND_EXECUTION]: The skill utilizes shell commands via Bash to manipulate environment variables, file systems, and execute the nansen-cli binary for wallet management.
- [EXTERNAL_DOWNLOADS]: The skill installs the nansen-cli package via the Node package manager. This is identified as a legitimate vendor resource belonging to nansen-ai.
Audit Metadata