The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the gmgn-cli tool to retrieve token data and python3 to execute a local scoring script. The bash instructions include a whitelist for chain names (case $ch in ...) to ensure only valid arguments are passed to the CLI tool, preventing potential command injection via the CHAINS variable.
[INDIRECT_PROMPT_INJECTION]: Since the skill processes data from external markets (specifically token symbols), it is exposed to potential indirect injection. The embedded Python script includes a sanitization function (sym) that proactively strips control characters, terminal escape sequences, and markdown metacharacters (like pipes and backticks) from token symbols before they are printed in the final report.
[DYNAMIC_EXECUTION]: The skill writes its own data processing logic to a file (heat_rank.py) at runtime. This is handled securely by using mktemp -d to create an unguessable temporary directory and using quoted heredocs (<<'PY') to prevent the shell from incorrectly interpolating variables during the write process. The script logic is entirely contained within the skill and is not retrieved from a remote source.
[SAFE]: The skill requires a vendor-specific CLI tool (gmgn-cli). Instructions are provided to help the user configure their API key safely using the tool's own configuration commands. There is no evidence of unauthorized sensitive file access or data exfiltration.

gmgn-heat-rank