All three static findings are false positives. The Bash marker is a documentation fence, and the API-key references only declare configuration for the Nansen CLI. No prompt-injection, credential-exfiltration, or undisclosed command behavior was found in SKILL.md.
The skill intentionally runs the Nansen CLI and requires a NANSEN_API_KEY for data access. I found no prompt injection text or unrelated exfiltration instructions, but the external command and secret exposure risks are real for a community skill.
1
Files scanned
39
Lines analyzed
5
Review items
0
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill declares NANSEN_API_KEY as a required environment variable. That is legitimate for Nansen access, but it exposes a sensitive credential to the CLI execution context.
The metadata marks NANSEN_API_KEY as the primary environment variable for the skill. This confirms intentional secret use, so users must trust the invoked Nansen CLI with that credential.
The backtick marker is a Markdown code fence, but the fenced block directs execution of nansen CLI commands. The command scope is bounded to nansen, yet it still runs an external package with user-supplied token and chain values.