nansen-wallet-manager

• Outcome: Review
• Latest audit: Sep 29, 2026 · 3:28 AM UTC
• Version: 0.1.5

Overview

This skill is a disclosed wallet manager, but it gives agents high-impact wallet authority including token sends, full-balance sends, wallet deletion, and private-key export.

Install only if you intentionally want an agent to manage real wallets through Nansen. Treat send, --max, delete, and export --reveal as high-risk operations; require explicit human approval and prefer dry-run or redacted/file-based exports over printing secrets to the transcript.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

Send

bash

# Send native token (SOL, ETH) — password auto-resolved from keychain
nansen wallet send --to <addr> --amount 1.5 --chain solana

# Send entire balance

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

Send

bash

# Send native token (SOL, ETH) — password auto-resolved from keychain
nansen wallet send --to <addr> --amount 1.5 --chain solana

# Send entire balance

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This section explicitly documents nansen wallet export <name> --reveal, which prints private keys in plaintext to stdout. In an agent context, stdout commonly lands in terminal history, logs, telemetry, and conversation transcripts, creating a high risk of irreversible secret disclosure and wallet compromise. The surrounding note acknowledges the risk, but the skill still exposes a dangerously easy exfiltration path.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

warns on stderr when stdout is an interactive terminal)

nansen wallet export --reveal

Password auto-resolved from keychain (needed for --reveal / --file)

nansen wallet delete

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

| PRIVY_APP_ID | Privy application ID | | PRIVY_APP_SECRET | Privy application secret |

Create a Privy wallet

bash

nansen wallet create --provider privy