nansen-wallet-keychain-migration

• Outcome: Review
• Latest audit: Sep 29, 2026 · 3:29 AM UTC
• Version: 0.1.4

Overview

The skill has a legitimate wallet-migration purpose, but it directs an agent to handle wallet passwords and run private-key reveal commands, which needs careful review before installation.

Install only if you are comfortable letting the agent participate in wallet credential migration. Prefer performing password entry and any private-key-related verification yourself in a local terminal, and avoid sharing wallet passwords in chat or allowing the agent to read plaintext password files unless you fully understand the exposure risk.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

- User mentions they stored their password in `~/.nansen/.env`, a `.env` file, or `memory.md`
- User gets the stderr warning: `⚠ Password loaded from insecure .credentials file`
- User asks to "secure my wallet" or "migrate to keychain"
- User created a wallet before the keychain update was released

## Detect current state

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

- User mentions they stored their password in `~/.nansen/.env`, a `.env` file, or `memory.md`
- User gets the stderr warning: `⚠ Password loaded from insecure .credentials file`
- User asks to "secure my wallet" or "migrate to keychain"
- User created a wallet before the keychain update was released

## Detect current state

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

- User mentions they stored their password in `~/.nansen/.env`, a `.env` file, or `memory.md`
- User gets the stderr warning: `⚠ Password loaded from insecure .credentials file`
- User asks to "secure my wallet" or "migrate to keychain"
- User created a wallet before the keychain update was released

## Detect current state

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md

- User mentions they stored their password in `~/.nansen/.env`, a `.env` file, or `memory.md`
- User gets the stderr warning: `⚠ Password loaded from insecure .credentials file`
- User asks to "secure my wallet" or "migrate to keychain"
- User created a wallet before the keychain update was released

## Detect current state

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

2. Full setup check — flags the insecure .credentials file with a fix

nansen doctor --offline

3. Legacy pattern doctor does not cover: password written to ~/.nansen/.env

ls -la ~/.nansen/.env 2>/dev/null && echo "FOUND: ~/.nansen/.env (insecure)"

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

2. Full setup check — flags the insecure .credentials file with a fix

nansen doctor --offline

3. Legacy pattern doctor does not cover: password written to ~/.nansen/.env

ls -la ~/.nansen/.env 2>/dev/null && echo "FOUND: ~/.nansen/.env (insecure)"

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

2. Full setup check — flags the insecure .credentials file with a fix

nansen doctor --offline

3. Legacy pattern doctor does not cover: password written to ~/.nansen/.env

ls -la ~/.nansen/.env 2>/dev/null && echo "FOUND: ~/.nansen/.env (insecure)"

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

The skill instructs the agent to ask the human to provide their wallet password in chat or authorize reading it from a local plaintext file. Even with benign intent, collecting a secret through conversation or agent-controlled retrieval increases the risk of credential exposure in transcripts, memory, logs, or downstream tooling.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

> "Your wallet password is currently stored in ~/.nansen/.env, which is insecure.
> I can migrate it to your OS keychain. Please confirm the password you used when
> creating the wallet, or I can read it from ~/.nansen/.env if you authorize it."

**Step 2 — Migrate:**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

source ~/.nansen/.env causes the agent-run shell to ingest a plaintext password from disk, giving the agent direct access to sensitive credentials. Even though the command avoids echoing the value, the secret still enters the process environment and may be exposed through shell history, debugging, error handling, subprocess inheritance, or agent telemetry.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

var is available to the node process:

bash

source ~/.nansen/.env 2>/dev/null && nansen wallet secure

Step 3 — Verify the password actually decrypts the wallet:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 76% confidence

Finding

This section instructs use of wallet export --reveal to test decryption success, relying on output redirection to prevent disclosure. While output suppression helps, invoking a reveal-capable private key export in an agent workflow is dangerous because any redirection failure, wrapper behavior, tracing, or tool bug could expose private keys.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

Step 3 — Verify the password actually decrypts the wallet:

bash

# Unset env var to prove keychain works, then run a decrypting export with
# all output discarded — the exit code alone is the signal, so no key
# material can land in a transcript or log
unset NANSEN_WALLET_PASSWORD

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

Step 4 — Clean up the insecure file:

bash

rm -f ~/.nansen/.env

Path B: Password in .credentials file (auto-saved fallback)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

Like the earlier verification step, this uses nansen wallet export default --reveal in an agent context. Even with stdout/stderr redirected, invoking a private-key reveal path is unnecessarily risky because any logging bug, wrapper, crash dump, or command misbehavior could disclose key material.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

Unset env var to prove keychain works

unset NANSEN_WALLET_PASSWORD

This MUST exit 0 — it proves the keychain password decrypts the wallet.

Output is discarded on purpose: the exit code alone is the signal.

if nansen wallet export default --reveal > /dev/null 2>&1; then echo "decryption OK"; else echo "decryption FAILED"; fi

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

This guidance explicitly permits reading ~/.nansen/.env in the same command, which still gives the agent access to the plaintext wallet password. The fact that it avoids echoing the value lowers accidental disclosure risk but does not eliminate the core problem of agent-side secret handling.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md

- **NEVER store the password** in files, memory, logs, or conversation history
- **NEVER use `--human` flag** — interactive prompts break agents
- If the human authorizes reading `~/.nansen/.env`, read it in the same command
  (`source ~/.nansen/.env && nansen wallet secure`) — do not echo or log the value
- **ALWAYS verify after migration** with `nansen wallet export default --reveal > /dev/null 2>&1` (branch on the exit code; never let the output print) — `wallet show` does NOT prove the password works (it never loads the password)

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

nansen doctor --offline

3. Legacy pattern doctor does not cover: password written to ~/.nansen/.env

ls -la ~/.nansen/.env 2>/dev/null && echo "FOUND: ~/.nansen/.env (insecure)"

text

Interpret `x402.password.source`:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

### Path A: Password in `~/.nansen/.env` (old skill pattern)

The previous wallet skill told agents to write the password to `~/.nansen/.env`.

**Step 1 — Ask the human for their password:**

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:145