nansen-wallet-keychain-migration

• Outcome: Review
• Latest audit: Aug 19, 2026 · 3:43 AM UTC
• Version: 0.1.1

Overview

The skill has a coherent wallet-migration purpose, but it repeatedly tells agents to verify success by printing private keys, which is too risky for agent logs and transcripts.

Do not install this skill as written unless you are comfortable with an agent running commands that may print wallet private keys. A safer version should replace `nansen wallet export default` with a non-secret unlock/decryption check and require explicit user approval before any credential-file read or key-revealing operation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill directs the agent to run `nansen wallet export default` as a verification step, even though that command reveals private keys. Exporting private keys is far beyond what is necessary to confirm password migration and creates a direct secret-exposure path to terminal output, logs, or agent-visible transcripts.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill acknowledges that `wallet export` prints private keys, yet still includes that capability in the workflow. Private-key revelation is unnecessary for the stated goal of migrating password storage and materially increases the chance of credential compromise.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The document is internally inconsistent: it warns not to use `wallet export` because it prints private keys, then later mandates it for verification. That contradiction is dangerous because it normalizes a known-secret-exposing command as an expected operational step.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: This verification path instructs use of a command that will display private keys but does not provide a prominent warning at the point of use. In agent environments, stdout/stderr may be captured, summarized, or retained, making exposure of wallet secrets especially dangerous.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: These repeated verification instructions normalize private-key export across multiple migration branches without strong contextual warning. Repetition increases the likelihood that agents treat secret disclosure as routine and execute it automatically.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The post-migration section states that private-key export 'MUST' succeed, effectively requiring secret disclosure to complete the workflow. This creates a high-risk operational pattern where successful migration is tied to exposing the wallet's most sensitive material.

Credential Access

High

• Category: Privilege Escalation

Content

> "Your wallet password is currently stored in ~/.nansen/.env, which is insecure.
> I can migrate it to your OS keychain. Please confirm the password you used when
> creating the wallet, or I can read it from ~/.nansen/.env if you authorize it."

**Step 2 — Migrate:**

• Confidence: 86% confidence
• Finding: The skill explicitly contemplates reading a password from `~/.nansen/.env`, which is credential access behavior. Although framed as user-authorized migration, it still involves agent access to secrets from disk and therefore increases exposure risk if mishandled or logged.

Credential Access

High

• Category: Privilege Escalation

Content

- **NEVER store the password** in files, memory, logs, or conversation history
- **NEVER use `--human` flag** — interactive prompts break agents
- If the human authorizes reading `~/.nansen/.env`, read it in the same command
  (`source ~/.nansen/.env && nansen wallet secure`) — do not echo or log the value
- **ALWAYS verify after migration** with `nansen wallet export default` — `wallet show` does NOT prove the password works (it never loads the password)

• Confidence: 84% confidence
• Finding: This rule instructs agents to source `~/.nansen/.env` in-process to access the password, which is still a form of credential retrieval from local storage. Even with the stated intent to avoid logging, it expands agent capability to ingest secrets and relies on perfect operational hygiene.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:138