{"data":{"skill":{"slug":"internet-court-nansen-smart-money-tracker","name":"nansen-smart-money-tracker","icon":"📦","repo":"https://github.com/internet-court/internet-court-skill/tree/main/vendored/nansen/nansen-smart-money-tracker","status":"approved","author":"internet-court","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"5f81cbb9-de86-4a00-9de6-734e50bfa6c5","skill_id":"38a1c621-9bc0-4a7d-b0b4-8e1fe577edad","version":2,"content_hash":"v3:3f6e026a3363e0954ede7bef0cfe88d4475de137:5f503fa64753fad0dee1a5607e9fb159cfabcd8558c94a0d43d100bceefa1b49:b41d904819d4f7fbb678a1d5880bc4fe61e3892cd283202a185c3e02853b670e:736b696c6c732f696e7465726e65742d636f7572742f6e616e73656e2d736d6172742d6d6f6e65792d747261636b6572:54e14aa50d4e776df5c6513dbb1a8b9d","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 24 static findings are false positives caused by Markdown backticks, code-fence markers, and credential metadata. The skill is a short documentation-only guide for invoking the Nansen CLI; no executable code, credential handling, prompt injection, or data-exfiltration intent was found.","remediation":[{"issue":"Credential requirement is documented without setup guidance.","severity":"low","suggestion":"Tell users to store NANSEN_API_KEY in their local environment and never include it in prompts, command arguments, or exported output."},{"issue":"CLI examples accept user-selected filters and limits.","severity":"low","suggestion":"When implementing a wrapper, pass arguments as structured values and validate chain, label, field, and limit inputs instead of constructing shell strings."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":37,"line_start":25},{"file":"SKILL.md","line_end":41,"line_start":37},{"file":"SKILL.md","line_end":45,"line_start":41},{"file":"SKILL.md","line_end":46,"line_start":45},{"file":"SKILL.md","line_end":47,"line_start":46},{"file":"SKILL.md","line_end":48,"line_start":47},{"file":"SKILL.md","line_end":49,"line_start":48},{"file":"SKILL.md","line_end":50,"line_start":49},{"file":"SKILL.md","line_end":52,"line_start":50},{"file":"SKILL.md","line_end":54,"line_start":52},{"file":"SKILL.md","line_end":60,"line_start":54},{"file":"SKILL.md","line_end":61,"line_start":60},{"file":"SKILL.md","line_end":62,"line_start":61},{"file":"SKILL.md","line_end":63,"line_start":62},{"file":"SKILL.md","line_end":63,"line_start":63},{"file":"SKILL.md","line_end":65,"line_start":64},{"file":"SKILL.md","line_end":66,"line_start":65},{"file":"SKILL.md","line_end":70,"line_start":66},{"file":"SKILL.md","line_end":70,"line_start":70}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":11,"line_start":11}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":72,"audit_model":"claude","audited_at":"2026-07-21T03:39:43.324+00:00","created_at":"2026-07-21T03:52:34.715873+00:00","static_findings":[{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"All commands: `nansen research smart-money <sub> [options]`","category":"external_commands","line_end":21,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":37,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":41,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Filter by smart money category with `--labels`:","category":"external_commands","line_end":45,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `Fund` | Crypto funds |","category":"external_commands","line_end":46,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `Smart Trader` | All-time top performers |","category":"external_commands","line_end":47,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `30D Smart Trader` | Hot hands — top 30 days |","category":"external_commands","line_end":48,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `90D Smart Trader` | Top 90 days |","category":"external_commands","line_end":49,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `180D Smart Trader` | Top 180 days |","category":"external_commands","line_end":50,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `Smart HL Perps Trader` | Top Hyperliquid perp traders |","category":"external_commands","line_end":52,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":54,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":60,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--chain` | Required for netflow/dex-trades/holdings |","category":"external_commands","line_end":61,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--labels` | Filter by SM label (quote multi-word values) |","category":"external_commands","line_end":62,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--limit` | Number of results |","category":"external_commands","line_end":63,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--sort` | Sort field:direction (e.g. `value_usd:desc`) |","category":"external_commands","line_end":63,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--fields` | Select specific fields |","category":"external_commands","line_end":65,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--table` | Human-readable table output |","category":"external_commands","line_end":66,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--format csv` | CSV export |","category":"external_commands","line_end":70,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `perp-trades` is Hyperliquid-only. No `--chain` flag.","category":"external_commands","line_end":70,"severity":"medium","line_start":70},{"id":"env_access:SKILL.md:8:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"- NANSEN_API_KEY","category":"env_access","line_end":8,"severity":"high","line_start":8},{"id":"env_access:SKILL.md:11:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"primaryEnv: NANSEN_API_KEY","category":"env_access","line_end":11,"severity":"high","line_start":11},{"id":"blocker:SKILL.md:35:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"# Perp trades — Hyperliquid only (no --chain needed)","category":"blocker","line_end":35,"severity":"low","line_start":35},{"id":"blocker:SKILL.md:50:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| `Smart HL Perps Trader` | Top Hyperliquid perp traders |","category":"blocker","line_end":50,"severity":"low","line_start":50}],"finding_verdicts":[{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"This is inline Markdown documentation for a command syntax, not an executed shell command. The skill contains no executable script or command interpolation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"This is a Markdown Bash code fence that documents fixed Nansen CLI examples. It does not execute code or accept interpolated input.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"This is the closing delimiter of a Markdown code fence, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"This is prose with inline code identifying a CLI flag. It does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"This is a Markdown table label enclosed in backticks, not an executable command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"This is a Markdown table label enclosed in backticks, not an executable command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"This is a Markdown table label enclosed in backticks, not an executable command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"This is a Markdown table label enclosed in backticks, not an executable command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"This is a Markdown table label enclosed in backticks, not an executable command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"This is a Markdown table label enclosed in backticks, not an executable command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"This is a Markdown Bash code fence delimiter, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"This is a Markdown code fence delimiter, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"This is documentation for a fixed CLI option and does not execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"This is documentation for a fixed CLI option and does not execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"This is documentation for a fixed CLI option and does not execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"This is documentation for a fixed CLI option and example value, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"This is documentation for a fixed CLI option and does not execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"This is documentation for a fixed CLI option and does not execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"This is documentation for a fixed CLI option and does not execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","reason":"This is prose documenting a subcommand and flag restriction, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:8:generic-api-secret-keys","reason":"The metadata declares the Nansen API key required by the documented Nansen CLI. No code reads, prints, transmits, or exposes the environment variable.","verdict":"false_positive","confidence":0.97},{"id":"env_access:SKILL.md:11:generic-api-secret-keys","reason":"The primaryEnv metadata identifies the expected credential for the CLI. It is configuration metadata, not secret access or exfiltration logic.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:35:system-reconnaissance","reason":"The text identifies the Hyperliquid data source for a documented market query. It performs no host, network, or system reconnaissance.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:50:system-reconnaissance","reason":"The label describes a trader category. It does not inspect the local system or network.","verdict":"false_positive","confidence":0.97}],"semantic_findings":[],"subject_marketplace_commit_sha":"3f6e026a3363e0954ede7bef0cfe88d4475de137","subject_content_hash":"5f503fa64753fad0dee1a5607e9fb159cfabcd8558c94a0d43d100bceefa1b49","subject_tree_hash":"b41d904819d4f7fbb678a1d5880bc4fe61e3892cd283202a185c3e02853b670e","subject_plugin_path":"skills/internet-court/nansen-smart-money-tracker","audit_payload_hash":"54e14aa50d4e776df5c6513dbb1a8b9d","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"3f6e026a3363e0954ede7bef0cfe88d4475de137","contentHash":"5f503fa64753fad0dee1a5607e9fb159cfabcd8558c94a0d43d100bceefa1b49","treeHash":"b41d904819d4f7fbb678a1d5880bc4fe61e3892cd283202a185c3e02853b670e","pluginPath":"skills/internet-court/nansen-smart-money-tracker","auditPayloadHash":"54e14aa50d4e776df5c6513dbb1a8b9d"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"unavailable","url":null,"status":null},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"unavailable","verificationState":"not_verified"},"isLatest":true}}