Nansen Wallet Profiler

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may run Nansen wallet queries and consume API quota while performing analysis.

Why it was flagged

The skill permits the agent to run Nansen CLI commands. This is central to the wallet-profiler purpose, but users should notice that the agent can invoke those API-backed commands when the skill is used.

Skill content
allowed-tools: Bash(nansen:*)
Recommendation

Use the skill for specific wallet-analysis tasks and confirm large batch, trace, or export requests before running them.

What this means

Large trace or batch requests could consume Nansen credits or hit API limits.

Why it was flagged

The artifact explicitly documents that tracing can fan out into many API calls. This is disclosed and purpose-aligned, but it can affect cost or rate limits.

Skill content
`trace` makes many API calls — use `--width` conservatively.
Recommendation

Keep `--depth`, `--width`, and batch wallet lists small unless you intentionally want a broader analysis.

What this means

The skill can use the configured Nansen API key to query Nansen services and consume the associated account’s quota.

Why it was flagged

The skill requires a Nansen API key. This is expected for accessing Nansen data, but it delegates use of the user’s Nansen account credentials to the CLI.

Skill content
requires:
      env:
        - NANSEN_API_KEY
Recommendation

Use an API key intended for this purpose, rotate it if no longer needed, and monitor Nansen API usage.

What this means

Installing the skill also installs and trusts the external `nansen-cli` package.

Why it was flagged

The skill depends on installing an external Node package to supply its CLI. This is normal for this integration, but the provided artifacts do not include package source or a lockfile.

Skill content
node | package: nansen-cli | creates binaries: nansen
Recommendation

Install from a trusted registry/source and review the package provenance if your environment has strict supply-chain requirements.