gmgn-portfolio

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the agent to ask the user for their GMGN API key and then place it verbatim into a shell command/file (echo 'GMGN_API_KEY=<key_from_user>' > ...), which requires handling and outputting the secret value.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The SKILL.md explicitly requires using the gmgn-cli to fetch data from the GMGN API (gmgn.ai) and to parse fields such as common.twitter_username, common.tags and created-tokens—which originate from public/user-generated sources—and those fields are used to build wallet narratives and trading/following decisions, so untrusted third-party content is ingested and can materially influence actions.