Nansen General Search

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a straightforward Nansen search helper, with the main considerations being the required Nansen API key, the external CLI install, and a broad allowance to run Nansen CLI commands.

Before installing, confirm you trust the `nansen-cli` package and are comfortable giving the agent access to a Nansen API key. Use it for the documented search commands, and prefer a limited or dedicated API key if available.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The agent may be able to invoke broader Nansen CLI functionality than just the documented search examples, using the configured API key.

Why it was flagged

The agent is allowed to run any command under the `nansen` binary, while the skill’s examples only show `nansen research search` usage.

Skill content

allowed-tools: Bash(nansen:*)

Recommendation

Use the skill for the documented search workflows and consider narrowing the allowed command pattern if only search is intended.

Low

#ASI03: Identity and Privilege Abuse

What this means

Queries made through this skill may consume the user’s Nansen API access and operate under their account credentials.

Why it was flagged

The skill requires a Nansen API key, which gives the CLI access to the user’s Nansen account/API quota for the intended service.

Skill content

requires:
      env:
        - NANSEN_API_KEY
    primaryEnv: NANSEN_API_KEY

Recommendation

Use an appropriately scoped Nansen API key where possible, and monitor usage if API quotas or billing matter.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill depends on trust in the external `nansen-cli` package distribution.

Why it was flagged

The skill depends on installing an external Node package to provide the `nansen` binary; the provided artifacts do not show a pinned version or verified source details.

Skill content

node | package: nansen-cli | creates binaries: nansen

Recommendation

Install from a trusted package source and prefer pinned or verified versions when available.