nansen-wallet-migration by askeluv/nansen-cli
npx skills add https://github.com/askeluv/nansen-cli --skill nansen-wallet-migration当用户已使用旧版密码存储方法设置了 nansen-cli 钱包,并希望迁移到新的安全流程时,请使用此技能。
~/.nansen/.env、.env 文件或 memory.md 中⚠ Password loaded from insecure .credentials filewallet show 仅显示地址,并不加载或检查密码。要检测实际的密码存储情况,请检查存储的密码源:
# 1. 检查是否存在钱包
nansen wallet list 2>&1
# 2. 检查不安全的密码存储
ls -la ~/.nansen/.env 2>/dev/null && echo "FOUND: ~/.nansen/.env (insecure)"
ls -la ~/.nansen/wallets/.credentials 2>/dev/null && echo "FOUND: .credentials file (insecure)"
# 3. 尝试一个需要密码的操作(不设置环境变量)
nansen wallet export default 2>&1
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
解读 export 命令的输出:
⚠ Password loaded from ~/.nansen/wallets/.credentials → 需要迁移(路径 B)PASSWORD_REQUIRED JSON 错误 → 密码未持久化存储在任何地方(路径 C 或 D)~/.nansen/.env 中(旧版技能模式)之前的钱包技能指示代理将密码写入 ~/.nansen/.env。
步骤 1 —— 向用户询问密码:
“您的钱包密码当前存储在 ~/.nansen/.env 中,这是不安全的。我可以将其迁移到您的操作系统密钥链。请确认您创建钱包时使用的密码,或者如果您授权,我可以从 ~/.nansen/.env 中读取它。”
步骤 2 —— 迁移:
source 和 nansen wallet secure 必须在同一个 shell 中运行,以便环境变量对 node 进程可用:
source ~/.nansen/.env 2>/dev/null && nansen wallet secure
步骤 3 —— 验证密码确实能解密钱包:
# 取消设置环境变量以证明密钥链有效,然后导出以验证解密
unset NANSEN_WALLET_PASSWORD
nansen wallet export default 2>&1
如果导出成功(显示私钥),则迁移成功。如果显示 Incorrect password,则表示迁移了错误的密码 —— 运行 nansen wallet forget-password 并使用正确的密码重试。
步骤 4 —— 清理不安全的文件:
rm -f ~/.nansen/.env
.credentials 文件中(自动保存的备用方案)当 wallet create 无法访问操作系统密钥链(容器、CI 环境)时会发生这种情况。
nansen wallet secure
如果密钥链仍然不可用(例如,没有 D-Bus 的容器化 Linux),nansen wallet secure 将解释情况并提供替代方案。
迁移后,验证解密是否有效:
nansen wallet export default 2>&1
NANSEN_WALLET_PASSWORD 环境变量中# 将环境变量中的密码持久化到密钥链
nansen wallet secure
然后在不使用环境变量的情况下验证:
unset NANSEN_WALLET_PASSWORD
nansen wallet export default 2>&1
密码无法恢复。钱包的私钥使用 AES-256-GCM 加密,并且密码未存储在任何可恢复的地方。
告知用户:
“您的钱包密码无法恢复。如果此钱包中有资金,它们可能无法访问。您可以创建一个新钱包并转移任何仍可访问的资金。”
# 创建一个全新的钱包(用户必须提供新密码)
NANSEN_WALLET_PASSWORD="<new_password_from_user>" nansen wallet create --name new-wallet
在任何迁移之后,通过证明密钥链密码确实能够解密钱包来确认密码已正确迁移:
# 取消设置环境变量以证明密钥链有效
unset NANSEN_WALLET_PASSWORD
# 此操作必须成功 —— 它证明密钥链密码可以解密钱包
nansen wallet export default 2>&1
如果导出显示 Incorrect password,则表示错误的密码被保存到了密钥链。通过以下方式修复:
nansen wallet forget-password
NANSEN_WALLET_PASSWORD="<correct_password>" nansen wallet secure
如果 stderr 仍然显示 .credentials 警告,则密钥链迁移未成功 —— 检查操作系统密钥链服务是否正在运行(Linux 上是 secret-tool,macOS 上是 security)。
如果用户希望完全移除其持久化的密码:
nansen wallet forget-password
这将从操作系统密钥链和 .credentials 文件中清除密码。未来的钱包操作将需要设置 NANSEN_WALLET_PASSWORD 环境变量或重新运行 nansen wallet secure。
--human 标志 —— 交互式提示会中断代理~/.nansen/.env,请在同一个命令中读取(source ~/.nansen/.env && nansen wallet secure)—— 不要回显或记录该值nansen wallet export default —— wallet show 不能证明密码有效(它从不加载密码)每周安装数
1
代码仓库
GitHub 星标数
54
首次出现
1 天前
安全审计
已安装于
zencoder1
amp1
cline1
openclaw1
opencode1
cursor1
Use this skill when a user already has a nansen-cli wallet set up with the old password storage method and wants to migrate to the new secure flow.
~/.nansen/.env, a .env file, or memory.md⚠ Password loaded from insecure .credentials filewallet show only displays addresses and does NOT load or check the password. To detect the actual password situation, check for stored password sources:
# 1. Check if a wallet exists at all
nansen wallet list 2>&1
# 2. Check for insecure password stores
ls -la ~/.nansen/.env 2>/dev/null && echo "FOUND: ~/.nansen/.env (insecure)"
ls -la ~/.nansen/wallets/.credentials 2>/dev/null && echo "FOUND: .credentials file (insecure)"
# 3. Try an operation that requires the password (without setting env var)
nansen wallet export default 2>&1
Interpret the export output:
⚠ Password loaded from ~/.nansen/wallets/.credentials on stderr → needs migration (Path B)PASSWORD_REQUIRED JSON error → password not persisted anywhere (Path C or D)~/.nansen/.env (old skill pattern)The previous wallet skill told agents to write the password to ~/.nansen/.env.
Step 1 — Ask the human for their password:
"Your wallet password is currently stored in ~/.nansen/.env, which is insecure. I can migrate it to your OS keychain. Please confirm the password you used when creating the wallet, or I can read it from ~/.nansen/.env if you authorize it."
Step 2 — Migrate:
The source and nansen wallet secure MUST run in the same shell so the env var is available to the node process:
source ~/.nansen/.env 2>/dev/null && nansen wallet secure
Step 3 — Verify the password actually decrypts the wallet:
# Unset env var to prove keychain works, then export to verify decryption
unset NANSEN_WALLET_PASSWORD
nansen wallet export default 2>&1
If export succeeds (shows private keys), the migration worked. If it shows Incorrect password, the wrong password was migrated — run nansen wallet forget-password and retry with the correct password.
Step 4 — Clean up the insecure file:
rm -f ~/.nansen/.env
.credentials file (auto-saved fallback)This happens when wallet create couldn't access the OS keychain (containers, CI).
nansen wallet secure
If the keychain is still unavailable (e.g. containerized Linux without D-Bus), nansen wallet secure will explain the situation and suggest alternatives.
After migrating, verify decryption works:
nansen wallet export default 2>&1
NANSEN_WALLET_PASSWORD env var# Persist the env var password to keychain
nansen wallet secure
Then verify without the env var:
unset NANSEN_WALLET_PASSWORD
nansen wallet export default 2>&1
The password cannot be recovered. The wallet's private keys are encrypted with AES-256-GCM and the password is not stored anywhere recoverable.
Tell the human:
"Your wallet password cannot be recovered. If you have funds in this wallet, they may be inaccessible. You can create a new wallet and transfer any remaining accessible funds."
# Create a fresh wallet (human must provide a new password)
NANSEN_WALLET_PASSWORD="<new_password_from_user>" nansen wallet create --name new-wallet
After any migration, confirm the password was migrated correctly by proving the keychain password can actually decrypt the wallet:
# Unset env var to prove keychain works
unset NANSEN_WALLET_PASSWORD
# This MUST succeed — it proves the keychain password decrypts the wallet
nansen wallet export default 2>&1
If export shows Incorrect password, the wrong password was saved to the keychain. Fix with:
nansen wallet forget-password
NANSEN_WALLET_PASSWORD="<correct_password>" nansen wallet secure
If stderr still shows the .credentials warning, the keychain migration did not succeed — check if the OS keychain service is running (secret-tool on Linux, security on macOS).
If the user wants to remove their persisted password entirely:
nansen wallet forget-password
This clears the password from both OS keychain and .credentials file. Future wallet operations will require NANSEN_WALLET_PASSWORD env var or re-running nansen wallet secure.
--human flag — interactive prompts break agents~/.nansen/.env, read it in the same command (source ~/.nansen/.env && nansen wallet secure) — do not echo or log the valuenansen wallet export default — wallet show does NOT prove the password works (it never loads the password)Weekly Installs
1
Repository
GitHub Stars
54
First Seen
1 day ago
Security Audits
Gen Agent Trust HubWarnSocketPassSnykFail
Installed on
zencoder1
amp1
cline1
openclaw1
opencode1
cursor1
xdrop 文件传输脚本:Bun 环境下安全上传下载工具,支持加密分享
28,800 周安装