Nansen Trading

Execute DEX swaps on Solana or Base, including cross-chain bridges. Use when buying or selling a token, getting a swap quote, or executing a trade.

This skill appears to be a legitimate CLI wrapper for trading, but there are important mismatches and risks to check before installing: - Verify the nansen-cli package: inspect its npm and GitHub source, recent publisher, and make sure it is the official CLI. Npm packages can contain arbitrary code during install. - Confirm the config path behavior: SKILL.md expects ~/.nansen/.env for the wallet password but the skill metadata does not declare any required config paths. Ask the publisher to declare required config paths and explain how secrets are stored. - Avoid storing wallet passwords in plaintext. If possible, use a hardware wallet or an approach that does not require persisting a plaintext password in ~/.nansen/.env. If you must persist, restrict file permissions, encrypt the file, and understand where the keys live. - Limit credential scope: use a dedicated API key and dedicated wallet with minimal funds for automation, not your main accounts. - Consider running install and CLI usage in an isolated environment (container/VM) and audit network calls if you will grant this agent NANSEN_API_KEY and the wallet password. If you decide to proceed, request clarification from the skill author about the missing config-path declaration and how wallet secrets are managed and rotated; do not provide your primary wallet credentials until you have verified the CLI source and storage behavior.

Type: OpenClaw Skill Name: nansen-trading Version: 0.1.4 The skill facilitates cryptocurrency trading and cross-chain bridging, which are inherently high-risk operations for an autonomous agent. It is classified as suspicious because SKILL.md explicitly instructs the agent to persist the sensitive 'NANSEN_WALLET_PASSWORD' in a local file (~/.nansen/.env), a significant security vulnerability that exposes credentials to any process or user with file system access. While these capabilities are aligned with the stated purpose of the 'nansen-cli' tool, the combination of credential persistence and irreversible financial transaction execution poses a substantial risk without additional safeguards.