gmgn-heat-rank
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill dynamically creates a Python script (
heat_rank.py) within a temporary directory created viamktemp -dand executes it usingpython3. The script's content is provided directly within theSKILL.MDfile. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted token metadata (symbols and analytics) fetched from external chains via the
gmgn-cli. It implements a mandatory evidence chain: - Ingestion points: Data is ingested from the
gmgn-cli market trendingcommand into local JSON files and then read by the Python script. - Boundary markers: The skill uses a dedicated sanitization function
sym()that explicitly replaces markdown metacharacters (pipes|, backticks`) and terminal escapes with placeholders to prevent the data from breaking the report structure or escaping the shell context. - Capability inventory: The skill uses shell command execution (
gmgn-cli) and local script execution (python3). - Sanitization: In addition to character stripping, the skill employs numeric normalization and validation to prevent data faults (like NaN or infinite values) from causing crashes or logical errors.
Audit Metadata