nansen-trading

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:23 AM UTC
• Version: 0.1.7

Overview

This trading skill is aligned with its stated purpose, but it should be reviewed carefully because it tells agents to persist a wallet password in a plaintext env file for irreversible trading actions.

Install only if you are comfortable letting the Nansen CLI perform irreversible trades from your wallet. Prefer a hardware wallet, OS keychain, or other secret manager instead of a plaintext ~/.nansen/.env password, use a limited wallet, pin and review the CLI version where possible, and require human review of token, chain, amount, destination, slippage, leverage, and fees before execution.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:183
• Finding: Plaintext Persistence of Wallet Encryption Password## Vulnerability Details **File Location**: `SKILL.md`, lines 183–186 **Vulnerability Type**: Plaintext storage and persistent exposure of sensitive credentials **Risk Level**: High **Complete Code Snippet**: ```markdown | `NANSEN_WALLET_PASSWORD` | **Required for `trade execute`.** Wallet encryption password — persisted in `~/.nansen/.env`. Source before executing: `source ~/.nansen/.env && nansen trade execute ...` | | `NANSEN_API_KEY` | API key (also set via `nansen login`) | > **Agents:** Never hold a wallet password only in session memory. If `NANSEN_WALLET_PASSWORD` is not in `~/.nansen/.env`, follow the setup flow in the nansen-wallet-manager skill Password Policy to generate and persist one before proceeding. ``` ### Technical Analysis The Skill explicitly instructs agents to persist a wallet encryption password in `~/.nansen/.env` and source that file before executing trades. A dotenv file is ordinarily plaintext and does not provide protection equivalent to an operating-system credential store or dedicated secret manager. Persistent storage is not the minimum privilege necessary to decrypt a wallet for one authorized transaction. Sourcing the file also exports its variables into the shell environment, making the password available to the invoked CLI and potentially to inherited subprocesses, diagnostic output, crash reporting, or other processes able to inspect the user's environment. The instruction increases both the lifetime and exposure surface of a credential protecting assets and irreversible transaction capabilities. No evidence in the audited file confirms deliberate transmission of the wallet password to an unrelated network service. The confirmed issue is insecure local persistence and environment exposure. ### Attack Path 1. A user or agent follows the Skill instruction and stores `NANSEN_WALLET_PASSWORD` in `~/.nansen/.env`. 2. The file remains on disk beyond the trading session. 3. A malicious pro ...[truncated 1007 chars]
• Remediation: ## Remediation Suggestions - Do not require agents to persist wallet passwords in plaintext dotenv files. - Store the credential in an operating-system keychain, hardware-backed credential store, or dedicated secret manager with explicit access controls and audit logging. - Prefer an interactive, non-echoing password prompt for each signing operation when persistent storage is unnecessary. - Pass the credential only to the exact process that needs it, and avoid exporting it broadly through `source`. - If file-based storage must remain as a compatibility fallback: - Enforce owner-only permissions such as mode `0600`. - Verify file ownership before reading it. - Keep wallet credentials in a dedicated file rather than a general-purpose environment file. - Exclude the file from source control, logs, telemetry, backups, and synchronization tools. - Document secure deletion and password-rotation procedures. - Prefer hardware-wallet or external-signer support so the CLI does not need a reusable wallet-decryption password. - Clear temporary environment variables immediately after use and ensure subprocesses do not inherit them unnecessarily.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10
• Finding: Unpinned Third-Party Trading CLI with Credential and Signing Access## Vulnerability Details **File Location**: `SKILL.md`, lines 10–13 **Vulnerability Type**: Unpinned executable dependency and supply-chain exposure **Risk Level**: Medium **Complete Code Snippet**: ```yaml install: - kind: node package: nansen-cli bins: [nansen] ``` ### Technical Analysis The Skill installs `nansen-cli` by package name without specifying an exact version or integrity digest. Dependency resolution can therefore select a future package release whose contents differ from those reviewed when the Skill was audited. This dependency is particularly sensitive because the Skill authorizes it to receive an API key and wallet password, interact with wallet material, construct and sign transactions, and broadcast irreversible financial operations. None of the dependency's executable implementation is included in the audited project, so its behavior cannot be validated from `SKILL.md`. This is not evidence that the current package is malicious. The vulnerability is the absence of immutable dependency selection and integrity verification for a component operating with high-impact credentials and transaction-signing authority. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, the publication pipeline, or another relevant supply-chain component. 2. The attacker publishes a modified `nansen-cli` release under the expected package name. 3. A subsequent installation resolves the unpinned dependency to the compromised release. 4. The Skill invokes the compromised `nansen` executable as a legitimate trading tool. 5. The executable receives access to the API key, wallet password, wallet files, quote identifiers, transaction details, and network connectivity. 6. It can exfiltrate credentials, substitute token or destination addresses, manipulate trade parameters, or sign and broadcast unauthorized transactions. ### Impact Assessment A compromised dependency would execute ...[truncated 555 chars]
• Remediation: ## Remediation Suggestions - Pin `nansen-cli` to an exact, security-reviewed version rather than resolving the latest compatible release. - Record and verify the package integrity digest using a lockfile or trusted immutable artifact. - Require provenance or signature verification where supported. - Install from a controlled registry or approved internal mirror with package admission policies. - Review package ownership, publication history, lifecycle scripts, transitive dependencies, and repository-to-package correspondence. - Disable or tightly control npm lifecycle scripts when they are not required. - Re-audit every dependency update before changing the pinned version or integrity value. - Execute the CLI in a restricted environment with only the credentials, wallet files, filesystem paths, and network destinations required for the requested operation. - Add transaction verification before signing, including chain, token addresses, destination wallet, amount, slippage, approvals, bridge destination, and quote expiry. - Prefer an external signer or hardware wallet that displays transaction details and requires explicit user confirmation.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Credential Access

High

• Category: Privilege Escalation

Content

| Var | Purpose |
|-----|---------|
| `NANSEN_WALLET_PASSWORD` | **Required for `trade execute`.** Wallet encryption password — persisted in `~/.nansen/.env`. Source before executing: `source ~/.nansen/.env && nansen trade execute ...` |
| `NANSEN_API_KEY` | API key (also set via `nansen login`) |

> **Agents:** Never hold a wallet password only in session memory. If `NANSEN_WALLET_PASSWORD` is not in `~/.nansen/.env`, follow the setup flow in the nansen-wallet-manager skill Password Policy to generate and persist one before proceeding.

• Confidence: 91% confidence
• Finding: The skill explicitly instructs agents to persist `NANSEN_WALLET_PASSWORD` in `~/.nansen/.env` and to `source` that file before executing trades. Persisting a wallet password in a plaintext env file materially increases the risk of credential disclosure via local file access, logs, shell history, other tools in the agent environment, or accidental exfiltration by adjacent skills; because this password protects a trading wallet, compromise can directly enable unauthorized asset transfers or trading.

Static analysis

No suspicious patterns detected.