The Agent Skills Directory

[COMMAND_EXECUTION]: The script analyze.py invokes the gmgn-cli tool to retrieve token data. It utilizes the subprocess.run function with argument lists rather than shell strings, which is a secure method that prevents shell injection attacks from user-provided inputs like token addresses.
[EXTERNAL_DOWNLOADS]: The skill instructions provide guidance for installing the gmgn-cli utility via the NPM registry. This is standard installation behavior for a tool provided by the skill's author (gmgnai) and does not involve untrusted remote code execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes data fetched from external blockchain sources which could theoretically contain malicious instructions.
Ingestion points: Holder and token metadata fetched via gmgn-cli in analyze.py and returned as script output.
Boundary markers: The skill instructions explicitly mandate that the agent paste the script output verbatim without adding commentary, which helps maintain context separation.
Capability inventory: The skill's primary capability is executing the fixed gmgn-cli tool and performing numerical analysis.
Sanitization: The Python script parses input as structured JSON and performs mathematical calculations on fields, treating the external data as data rather than instructions.

gmgn-holder-analysis