Nansen Wallet Clustering

Cluster and attribute related wallets — funding chains, shared signers, CEX deposit patterns. Use when tracing wallet ownership, comparing two wallets, findi...

Security Scan

The skill's requirements, instructions, and install spec align with its stated purpose (using the Nansen CLI and API key to cluster and attribute wallets); nothing requests unrelated credentials or system access.

Purpose & Capability

Name/description match required pieces: the skill invokes the nansen CLI and requires NANSEN_API_KEY, which are exactly what's needed to call Nansen research endpoints for wallet clustering and attribution.

Instruction Scope

SKILL.md lists explicit nansen CLI commands limited to profiling, related-wallets, counterparties, traces, comparisons, and batch cluster calls. It instructs the agent to ask the human before expanding to newly discovered addresses and gives stop rules (known CEX, low confidence, cluster >10). It does not instruct reading unrelated files, environment variables, or sending data to third‑party endpoints beyond Nansen.

Install Mechanism

Install is an npm package (nansen-cli) that provides the nansen binary. This is proportional to the task but carries normal npm supply-chain risk—expected for a CLI integration but worth checking the package source before granting API credentials.

Credentials

Only NANSEN_API_KEY is required and declared as the primary credential. No other tokens, keys, or config paths are requested. That is proportionate for a Nansen CLI skill.

Persistence & Privilege

The skill does not request always:true and does not ask to modify other skills or system-wide settings. Model invocation is allowed (platform default) but not combined with extra privileges here.

Assessment

This skill appears coherent and uses the Nansen CLI and your NANSEN_API_KEY as expected. Before installing: (1) Confirm you trust the nansen-cli npm package—review its source or install from a vetted source; (2) Be aware API queries (trace, cross-chain checks) consume Nansen credits—monitor usage and costs; (3) Limit the API key's scope if possible and monitor its activity/quotas; (4) The SKILL.md recommends asking for human confirmation before expanding to new addresses—keep that prompt behavior enabled to avoid broad automated querying. If you need additional assurance, request the nansen-cli package source or a checksum for the package you will install.

Wallet Attribution

Answers: "Who controls this wallet? Are these wallets related?"

Chain: 0x → --chain ethereum (also base, arbitrum, optimism, polygon). Base58 → --chain solana.

ADDR=<address> CHAIN=<ethereum|solana|base|...>  # detect from address format above
# 1. Identity
nansen research profiler labels --address $ADDR --chain $CHAIN
# 2. Related wallets (paginate with --page N)
nansen research profiler related-wallets --address $ADDR --chain $CHAIN
# 3. Counterparties (paginate with --page N; widen with --days 365 if empty)
nansen research profiler counterparties --address $ADDR --chain $CHAIN --days 90
# 4. Batch profile cluster
nansen research profiler batch --addresses "addr1,addr2" --chain $CHAIN --include labels,balance,pnl
# 5. Compare pairs → shared_counterparties, shared_tokens, balances
nansen research profiler compare --addresses "addr1,addr2" --chain $CHAIN
# 6. Historical balances (fingerprint drained wallets)
nansen research profiler historical-balances --address $ADDR --chain $CHAIN --days 90
# 7. Multi-hop trace (credit-heavy — keep --width ≤3)
nansen research profiler trace --address $ADDR --chain $CHAIN --depth 2 --width 3

Expansion: Run steps 1-2 on seed. For each new address found, ask the human before querying. Reserve step 3 for seed only. Stop when: known protocol/CEX · Low confidence · already visited · cluster > 10 wallets. Confidence: High = first funder / shared Safe signers / same CEX deposit. Medium = coordinated movements / related-wallets + label match. Exclude = ENS only, single CEX withdrawal, single deployer. Full attribution rules in REFERENCE.md.