nansen-web-fetch
Pass
Audited by Gen Agent Trust Hub on Mar 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
nansenCLI tool to perform web fetching and AI-driven analysis of URL content. This is the primary advertised function of the skill and is handled via a vendor-provided binary. - [EXTERNAL_DOWNLOADS]: The skill specifies the installation of the
nansen-clipackage from the Node.js package registry. This package belongs to the verified author 'nansen-ai' and is a standard requirement for the tool's operation. - [PROMPT_INJECTION]: The skill fetches data from external URLs which could contain malicious instructions (indirect prompt injection). This is a known risk for any web-fetching AI tool. * Ingestion points: External URLs provided as arguments to the
nansen web fetchcommand. * Boundary markers: None explicitly provided in the CLI usage examples to separate content from instructions. * Capability inventory: The skill has the capability to fetch content from the network and process it using Gemini 2.5 Flash. * Sanitization: Content is processed by a managed AI model with built-in safety guardrails.
Audit Metadata