Nansen Wallet Keychain Migration

What it does

When your agent uses it

• Backend & APIs work in your project

Example prompts

• “/nansen-wallet-keychain-migration”

Requirements

• A credential in NANSEN_API_KEY
• Pre-approved tools (allowed-tools): Bash(nansen:*)

What it can do on your machine

Read from SKILL.md and the folder at commit d097942. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Bash(nansen:*)

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  No scripts in the folder and no shell commands in SKILL.md (its code samples are bash).

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names these keys or tokens, usually read from environment variables:

  • NANSEN_WALLET_PASSWORD
  • NANSEN_API_KEY

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Nansen Wallet Keychain Migration loads about 1.9k tokens when it runs. Until then it costs about 42 tokens; SKILL.md has 756 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~42

When it runs · the whole SKILL.md, loaded when a task matches

~1.9k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NoteMentions a .env fileSKILL.md:29

  they stored their password in `~/.nansen/.env`, a `.env` file, or `memory.md`

• NoteMentions a .env fileSKILL.md:46

  not cover: password written to ~/.nansen/.env

• NoteMentions a .env fileSKILL.md:47

  ls -la ~/.nansen/.env 2>/dev/null && echo "FOUND: ~/.nansen/.env (insecure)"

• NoteMentions a .env fileSKILL.md:54

  heck where it is being exported from (a `.env` file → Path A)

• NoteMentions a .env fileSKILL.md:60

  ### Path A: Password in `~/.nansen/.env` (old skill pattern)

• NoteMentions a .env fileSKILL.md:62

  ents to write the password to `~/.nansen/.env`.

• NoteMentions a .env fileSKILL.md:66

  assword is currently stored in ~/.nansen/.env, which is insecure.

• NoteMentions a .env fileSKILL.md:68

  wallet, or I can read it from ~/.nansen/.env if you authorize it."

• NoteMentions a .env fileSKILL.md:76

  source ~/.nansen/.env 2>/dev/null && nansen wallet secure

• NoteMentions a .env fileSKILL.md:96

  rm -f ~/.nansen/.env

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from nansen-ai/nansen-cli at commit d097942, republished under its MIT licence (© nansen-ai). 756 words, ~1,911 tokens.

name

nansen-wallet-keychain-migration

description

Migrate an existing nansen-cli wallet from insecure password storage (env files, .credentials) to the new secure keychain-backed flow.

allowed-tools

Bash(nansen:*)

# 1. Where is the password stored? Offline, decrypts nothing, prints no secrets
nansen auth status --pretty     # → x402.password.source: "env" | "keychain" | "file" | null

# 2. Full setup check — flags the insecure .credentials file with a fix
nansen doctor --offline

# 3. Legacy pattern doctor does not cover: password written to ~/.nansen/.env
ls -la ~/.nansen/.env 2>/dev/null && echo "FOUND: ~/.nansen/.env (insecure)"

source ~/.nansen/.env 2>/dev/null && nansen wallet secure

# Unset env var to prove keychain works, then run a decrypting export with
# all output discarded — the exit code alone is the signal, so no key
# material can land in a transcript or log
unset NANSEN_WALLET_PASSWORD
if nansen wallet export default --reveal > /dev/null 2>&1; then echo "decryption OK"; else echo "decryption FAILED"; fi

rm -f ~/.nansen/.env

nansen wallet secure

if nansen wallet export default --reveal > /dev/null 2>&1; then echo "decryption OK"; else echo "decryption FAILED"; fi

# Persist the env var password to keychain
nansen wallet secure

unset NANSEN_WALLET_PASSWORD
if nansen wallet export default --reveal > /dev/null 2>&1; then echo "decryption OK"; else echo "decryption FAILED"; fi

# Create a fresh wallet (human must provide a new password)
NANSEN_WALLET_PASSWORD="<new_password_from_user>" nansen wallet create --name new-wallet

# Unset env var to prove keychain works
unset NANSEN_WALLET_PASSWORD

# This MUST exit 0 — it proves the keychain password decrypts the wallet.
# Output is discarded on purpose: the exit code alone is the signal.
if nansen wallet export default --reveal > /dev/null 2>&1; then echo "decryption OK"; else echo "decryption FAILED"; fi

nansen wallet forget-password
NANSEN_WALLET_PASSWORD="<correct_password>" nansen wallet secure

nansen wallet forget-password

© nansen-ai, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/nansen-wallet-keychain-migration of nansen-ai/nansen-cli.

Open the folder on GitHubat commit d097942