The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill explicitly identifies that all external data sources (on-chain metadata, social media posts, and web page content) are attacker-controlled inputs.
Ingestion points: Untrusted data enters the agent context via gmgn-cli (token metadata), social search APIs (X/Grok posts), and a dedicated web fetch interface (external websites).
Boundary markers: The instructions include a strict "Hard Rule" and an explicit warning header informing the agent to treat all external text as data to be summarized, never as instructions to follow. It mandates that any instruction-shaped text found in external sources be reported as a risk finding rather than obeyed.
Capability inventory: The skill has access to gmgn-cli for chain data, network access via social APIs, and a restricted web fetch tool.
Sanitization: The gmgn-cli tool is described as sanitizing metadata by stripping control/zero-width/bidi characters and replacing instruction-shaped text with filtered markers.
[EXTERNAL_DOWNLOADS]: The skill defines a pluggable web content fetch interface in references/interfaces.md for verifying claims. This interface implements rigorous security controls to mitigate risks associated with fetching attacker-provided URLs.
SSRF Protection: It mandates the rejection of private, loopback, and link-local IP ranges (RFC 1918, cloud metadata addresses).
DNS Rebinding Protection: It requires resolving hostnames and pinning the resulting IP address to prevent rebinding attacks between validation and connection.
Resource Limits: The interface enforces hard timeouts and response size caps to prevent resource exhaustion.
[COMMAND_EXECUTION]: The skill utilizes a vendor-specific command-line tool, gmgn-cli, for on-chain research.
Evidence: Instructions in SKILL.md guide the user or agent to run gmgn-cli config and npm install -g gmgn-cli to maintain the environment. Since these commands refer to the skill author's own verified tools (gmgnai), they are considered legitimate functional requirements.
[CREDENTIALS_SAFE]: The skill requires API keys for both the core token data and social search capabilities.
Secret Management: It follows best practices by using runtime-injected secrets (SOCIAL_SEARCH_API_KEY) and explicitly forbidding the agent from logging or echoing these values in any user-visible output or error messages.

gmgn-narrative