Audit History

All 31 static findings are false positives caused by Markdown code formatting, CLI documentation, and environment-requirement metadata. The skill contains illustrative Nansen CLI queries only; no embedded shell execution, credential handling, reconnaissance, prompt injection, or exfiltration intent was found.

Most static backtick findings are false positives from Markdown inline code and fenced command examples in SKILL.md. The API key findings declare required configuration, not hardcoded secrets. A semantic finding notes the broad Bash(nansen:*) tool allowance and recommends narrowing the command surface.