Nansen Smart Money Trend

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:38 AM UTC
• Version: 0.1.0

Overview

The skill matches its stated Nansen research purpose, but it should be reviewed because it installs an unpinned third-party CLI that receives a Nansen API key.

Install only if you trust the current nansen-cli npm package and are comfortable exposing a revocable Nansen API key to it. Prefer a pinned, reviewed CLI version and validate token addresses and chain names before running the commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:10
• Finding: Unpinned Third-Party CLI Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 10–13 **Vulnerability Type**: Unpinned third-party package installation **Risk Level**: High ### Vulnerable Code ```yaml install: - kind: node package: nansen-cli bins: [nansen] ``` ### Technical Analysis The Skill requests installation of `nansen-cli` without specifying an exact version, lockfile, integrity hash, or other provenance control. Consequently, the package resolved during installation may differ from the version originally reviewed. Because npm packages execute locally and may run installation lifecycle scripts, compromise of the package, its publication account, or a transitive dependency could introduce arbitrary code into the Agent environment. The Skill also requires `NANSEN_API_KEY`, making that credential potentially accessible to a malicious CLI process. ### Attack Path 1. An attacker compromises the `nansen-cli` package, its maintainer account, or a transitive dependency. 2. The attacker publishes a malicious version under the expected package name. 3. The Agent installs the package without enforcing an audited version or integrity value. 4. Malicious package code executes during installation or when the `nansen` binary is invoked. 5. The code accesses available environment variables, including `NANSEN_API_KEY`, and may transmit credentials or execute additional actions using the Agent's operating-system privileges. ### Impact Assessment Successful exploitation could allow arbitrary code execution with the privileges of the process installing or running the Skill. Potential consequences include theft of the Nansen API key, unauthorized API activity, manipulation of analytics results, access to files available to the Agent, and compromise of other credentials exposed to the same process. The scope is limited by the permissions, filesystem access, network access, and environment variables granted to the Agent runtime. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `nansen-cli` to an exact, reviewed version rather than resolving the latest available release. - Enforce package integrity through a lockfile and registry-provided integrity hashes. - Verify that the package name and publisher correspond to the official Nansen distribution. - Review the package and its transitive dependency tree before deployment. - Disable package lifecycle scripts where feasible, or install dependencies in an isolated build environment. - Run the CLI in a sandbox with minimal filesystem and network permissions. - Expose `NANSEN_API_KEY` only to the specific command that requires it, and use a narrowly scoped, revocable API key. - Establish a controlled dependency-update process that requires review before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:16
• Finding: Insufficient Validation and Quoting of Shell Parameters<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 16–25 **Vulnerability Type**: Unsafe handling of user-derived command-line parameters **Risk Level**: Medium ### Vulnerable Code ```bash TOKEN=<address> CHAIN=ethereum nansen research smart-money netflow --chain $CHAIN --limit 200 # → filter by token_address; net_flow_1h_usd, net_flow_24h_usd, net_flow_7d_usd, net_flow_30d_usd nansen research token holders --token $TOKEN --chain $CHAIN --smart-money --limit 20 # → address_label, value_usd, balance_change_24h, balance_change_7d, balance_change_30d nansen research token flow-intelligence --token $TOKEN --chain $CHAIN # → smart_trader_net_flow_usd, whale_net_flow_usd, fund_net_flow_usd, fresh_wallets_net_flow_usd nansen research token dex-trades --token $TOKEN --chain $CHAIN --limit 50 # → block_timestamp, action, trader_address_label — find oldest SM-labeled BUY ``` ### Technical Analysis The documented commands use `$TOKEN` and `$CHAIN` without quoting or validating their values. Unquoted shell expansion permits word splitting and pathname expansion. A value beginning with a hyphen may also be interpreted as one or more CLI options if the target CLI parser accepts options in that position. Ordinary shell variable expansion does not independently reinterpret semicolons or command substitutions embedded literally inside a variable. However, command execution becomes possible if an Agent constructs the assignment statement by directly substituting untrusted text into `TOKEN=<address>`, or otherwise evaluates the generated command through mechanisms such as `eval`, `sh -c`, or equivalent dynamic shell construction. Therefore, exploitation depends on how the template is instantiated. At minimum, malformed input can alter argument boundaries or CLI behavior; unsafe direct interpolation can escalate the issue to shell command injection. ### Attack Path 1. An attacker supplies a crafted token address or chain value to an Agent using the Ski ...[truncated 1191 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Validate token addresses before invocation. For Ethereum, require the intended canonical address format, such as `0x` followed by exactly 40 hexadecimal characters. - Permit only explicitly supported chain identifiers through an allowlist. - Quote every variable expansion: ```bash nansen research smart-money netflow --chain "$CHAIN" --limit 200 nansen research token holders --token "$TOKEN" --chain "$CHAIN" --smart-money --limit 20 nansen research token flow-intelligence --token "$TOKEN" --chain "$CHAIN" nansen research token dex-trades --token "$TOKEN" --chain "$CHAIN" --limit 50 ``` - Reject values beginning with `-` unless they have already passed a strict format validator. - Do not build shell assignment statements or complete commands by concatenating raw user input. - Do not pass generated command strings to `eval`, `sh -c`, `bash -c`, or equivalent evaluators. - Where supported, invoke the CLI with an argument array rather than through shell command-string construction. - Document accepted token and chain formats so the Agent can reject malformed input before invoking Bash. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.