All five external-command detections are false positives caused by Markdown inline code and fenced command examples, not executable Ruby or shell backticks. The two API-key detections document a required Nansen credential and do not show credential reading, transmission, or exfiltration within the skill file. No prompt injection or additional intent-level security issue was found.
The skill contains no prompt injection text or hidden authority claims. Several markdown backtick detections are false positives, but the skill does execute Nansen CLI screeners and requires NANSEN_API_KEY. The main risk is exposing a sensitive API credential to an installed third-party CLI.
The skill installs nansen-cli, permits Bash(nansen:*), and requires NANSEN_API_KEY. This gives an installed third-party CLI access to a sensitive user credential during execution.
The metadata explicitly combines a required API key, a node package install, and allowed Nansen Bash execution. No malicious intent is shown, but the trust-boundary risk is clear.
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
All commands: `nansen research prediction-market <sub> [options]` (alias: `nansen research pm <sub>`
Line 21 documents the Nansen CLI command pattern that the agent is expected to run. The command is bounded to nansen, but it is still external command execution.
The fenced block from lines 25 to 43 contains concrete nansen research commands intended for execution. The commands are narrow, but they run an installed external CLI.