Nansen Wallet Profiler

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to be a coherent Nansen CLI wrapper for wallet analysis, with expected API-key and CLI-use risks users should notice.

This appears safe to use for wallet profiling if you trust the `nansen-cli` package and are comfortable providing a Nansen API key. Before running broad batch or trace commands, check the wallet list and trace settings because they can generate many API calls and consume credits.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

The agent may run Nansen wallet queries and consume API quota while performing analysis.

Why it was flagged

The skill permits the agent to run Nansen CLI commands. This is central to the wallet-profiler purpose, but users should notice that the agent can invoke those API-backed commands when the skill is used.

Skill content

allowed-tools: Bash(nansen:*)

Recommendation

Use the skill for specific wallet-analysis tasks and confirm large batch, trace, or export requests before running them.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Large trace or batch requests could consume Nansen credits or hit API limits.

Why it was flagged

The artifact explicitly documents that tracing can fan out into many API calls. This is disclosed and purpose-aligned, but it can affect cost or rate limits.

Skill content

`trace` makes many API calls — use `--width` conservatively.

Recommendation

Keep `--depth`, `--width`, and batch wallet lists small unless you intentionally want a broader analysis.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

The skill can use the configured Nansen API key to query Nansen services and consume the associated account’s quota.

Why it was flagged

The skill requires a Nansen API key. This is expected for accessing Nansen data, but it delegates use of the user’s Nansen account credentials to the CLI.

Skill content

requires:
      env:
        - NANSEN_API_KEY

Recommendation

Use an API key intended for this purpose, rotate it if no longer needed, and monitor Nansen API usage.

NoteMedium Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill also installs and trusts the external `nansen-cli` package.

Why it was flagged

The skill depends on installing an external Node package to supply its CLI. This is normal for this integration, but the provided artifacts do not include package source or a lockfile.

Skill content

node | package: nansen-cli | creates binaries: nansen

Recommendation

Install from a trusted registry/source and review the package provenance if your environment has strict supply-chain requirements.