Nansen Wallet Profiler

• Verdict: Pass
• Analyzed: May 11, 2026, 7:45 AM
• Findings: 0
• Version: 0.1.0
• Hash: d47587bfd74b68de8b0af02b9cf38abe155d8ae731db3b272bcc069edbdeabd8
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: nansen-wallet-profiler Version: 0.1.0 The skill is a standard integration for the Nansen blockchain analytics platform, providing commands to profile wallet balances, transactions, and relationships via the `nansen-cli` tool. It follows security best practices by restricting the agent's execution environment to the `nansen` binary and requires a legitimate API key for operation, with no evidence of malicious intent or data exfiltration.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

NoteHigh Confidence

What this means

The agent may run Nansen wallet queries and consume API quota while performing analysis.

Why it was flagged

The skill permits the agent to run Nansen CLI commands. This is central to the wallet-profiler purpose, but users should notice that the agent can invoke those API-backed commands when the skill is used.

Skill content

allowed-tools: Bash(nansen:*)

Recommendation

Use the skill for specific wallet-analysis tasks and confirm large batch, trace, or export requests before running them.

ASI02: Tool Misuse and Exploitation

NoteHigh Confidence

What this means

Large trace or batch requests could consume Nansen credits or hit API limits.

Why it was flagged

The artifact explicitly documents that tracing can fan out into many API calls. This is disclosed and purpose-aligned, but it can affect cost or rate limits.

Skill content

`trace` makes many API calls — use `--width` conservatively.

Recommendation

Keep `--depth`, `--width`, and batch wallet lists small unless you intentionally want a broader analysis.

ASI03: Identity and Privilege Abuse

NoteHigh Confidence

What this means

The skill can use the configured Nansen API key to query Nansen services and consume the associated account’s quota.

Why it was flagged

The skill requires a Nansen API key. This is expected for accessing Nansen data, but it delegates use of the user’s Nansen account credentials to the CLI.

Skill content

requires:
      env:
        - NANSEN_API_KEY

Recommendation

Use an API key intended for this purpose, rotate it if no longer needed, and monitor Nansen API usage.

ASI04: Agentic Supply Chain Vulnerabilities

NoteMedium Confidence

What this means

Installing the skill also installs and trusts the external `nansen-cli` package.

Why it was flagged

The skill depends on installing an external Node package to supply its CLI. This is normal for this integration, but the provided artifacts do not include package source or a lockfile.

Skill content

node | package: nansen-cli | creates binaries: nansen

Recommendation

Install from a trusted registry/source and review the package provenance if your environment has strict supply-chain requirements.