nansen-wallet-manager

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:54 AM UTC
• Version: 0.1.2

Overview

This wallet skill is not clearly malicious, but it gives an agent broad power to move funds and expose or delete wallet keys while handling sensitive credentials in risky ways.

Review this skill carefully before installing. Use Privy/server-side wallets where possible, avoid providing wallet passwords through an agent chat, pin and verify the `nansen-cli` package, and require manual confirmation for any send, export, delete, or max-balance transaction.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11
• Finding: Unpinned Executable npm Dependency Creates Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:11-15` **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium ```yaml install: - kind: node package: nansen-cli bins: [nansen] ``` ### Technical Analysis The Skill installs `nansen-cli` without specifying an exact version or package integrity value. Consequently, installation may resolve to mutable registry content released after this Skill was audited. The installed package is then exposed as the authorized `nansen` executable through `allowed-tools`. Because the CLI performs sensitive wallet operations and receives access to API keys, wallet passwords, private keys, and transaction functionality, compromise of the package, its publisher account, or its transitive dependency chain could cause malicious code to execute with the privileges of the agent process. The project contains no lockfile, checksum, vendored source, or other mechanism by which the installed implementation can be verified. ### Attack Path 1. An attacker compromises the `nansen-cli` publishing account, package, or one of its install/runtime dependencies. 2. The attacker publishes a modified version under the same package name. 3. A subsequent Skill installation resolves the unpinned package reference to that modified release. 4. Malicious lifecycle or runtime code executes during installation or when an authorized `nansen` command is invoked. 5. The compromised process accesses credentials available to the CLI, alters wallet operations, or substitutes transaction parameters. ### Impact Assessment Exploitation would occur with the operating-system privileges of the process installing or running the CLI. Potentially exposed assets include `NANSEN_API_KEY`, `NANSEN_WALLET_PASSWORD`, Privy credentials, locally available wallet material, and transaction authorization capabilities. A compromised CLI could steal secrets, export accessible local wallet ...[truncated 231 chars]
• Remediation: ## Remediation Suggestions - Pin `nansen-cli` to an exact, reviewed version rather than resolving a mutable latest release. - Use a lockfile and verify package integrity hashes during installation. - Confirm that the package name and publisher are the official distribution source. - Disable npm lifecycle scripts where operationally feasible. - Review and pin transitive dependencies, and continuously monitor them for compromise or known vulnerabilities. - Run the CLI in a restricted environment with access only to credentials required for the current operation. - Require transaction previews and explicit human confirmation before any value-moving operation.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:77
• Finding: Wallet Password Is Exposed Through Agent-Visible Command Construction## Vulnerability Details **File Location**: `SKILL.md:77-84` **Additional Occurrences**: `SKILL.md:102-108`, `SKILL.md:123-128` **Vulnerability Type**: Insecure handling of wallet encryption credentials **Risk Level**: High ```markdown Wallet creation requires a password from the **human user**. The agent must NOT generate or store the password itself. > **Step 1 (Agent → Human):** Ask the user to provide a wallet password (minimum 12 characters). > > **Step 2 (Agent executes):** Run the create command with the password the user gave you. ```bash NANSEN_WALLET_PASSWORD="<password_from_user>" nansen wallet create ``` ``` The named-wallet example repeats the same pattern: ```bash NANSEN_WALLET_PASSWORD="<password_from_user>" nansen wallet create NANSEN_WALLET_PASSWORD="<password_from_user>" nansen wallet create --name trading ``` ### Technical Analysis The instructions require the human user to disclose a wallet password to the agent and then require the agent to interpolate that secret into a Bash command. This design conflicts with the adjacent rule that the password must never be stored in logs, memory, or conversation history. The password may be retained in the conversation transcript, model or tool-call telemetry, command audit logs, shell history, diagnostic output, or process environment. Although an inline environment assignment is preferable to placing a secret in a command argument on some systems, it does not protect the secret from the agent orchestration layer that constructs and records the complete command. Depending on the execution environment, another process with sufficient local privileges may also be able to inspect process environment data. This exposure is unnecessary if the CLI supports a human-controlled hidden prompt, protected standard input, a file descriptor, or a secret-manager reference that does not reveal the password to the model. ### Attack Pat ...[truncated 1390 chars]
• Remediation: ## Remediation Suggestions - Do not ask users to disclose wallet passwords in an agent conversation. - Implement a human-controlled hidden-input flow in which the password is entered directly into the trusted CLI or secret-management interface without passing through the model. - Add support for reading the password from a protected file descriptor or standard input, ensuring that the secret is not included in command text. - Where automation is required, pass an opaque secret-manager reference and resolve it only inside the trusted execution boundary. - Disable or redact command, environment, and tool-call telemetry for secret-bearing operations. - Ensure the password is never written to shell history, diagnostic output, temporary files, or persistent agent memory. - Clear secret-bearing environment variables immediately after use and restrict process inspection through operating-system isolation. - Prefer the OS keychain workflow documented by the Skill, but bootstrap it through a mechanism that does not reveal the initial password to the agent.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Credential Access

High

• Category: Privilege Escalation

Content

## Send

```bash
# Send native token (SOL, ETH) — password auto-resolved from keychain
nansen wallet send --to <addr> --amount 1.5 --chain solana

# Send entire balance

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Send

```bash
# Send native token (SOL, ETH) — password auto-resolved from keychain
nansen wallet send --to <addr> --amount 1.5 --chain solana

# Send entire balance

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Export & Delete

```bash
# Password auto-resolved from keychain
nansen wallet export <name>
nansen wallet delete <name>
```

• Confidence: 91% confidence
• Finding: The documented `nansen wallet export <name>` operation enables private key extraction for local wallets, with password resolution handled automatically from saved credentials. In an agent context, exposing an export capability is highly sensitive because a compromised, over-permissioned, or prompt-injected agent could exfiltrate wallet private keys without requiring fresh user approval.

Session Persistence

Medium

• Category: Rogue Agent

Content

| `PRIVY_APP_ID` | Privy application ID |
| `PRIVY_APP_SECRET` | Privy application secret |

### Create a Privy wallet

```bash
nansen wallet create --provider privy

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:84