skills/gmgnai/gmgn-skills/gmgn-track/Gen Agent Trust Hub

gmgn-track

Pass

Audited by Gen Agent Trust Hub on Apr 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes several local shell commands, including openssl for Ed25519 key generation, and ifconfig or ip addr for IPv6 connectivity diagnostics during troubleshooting.
  • [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the gmgn-cli global Node.js package, which is the primary tool for interacting with the GMGN tracking API.
  • [PROMPT_INJECTION]: The skill processes external blockchain trade data (such as wallet names and token symbols) from the GMGN API, creating a vulnerability surface for indirect prompt injection. Ingestion points: Trade records fetched via gmgn-cli track sub-commands. Boundary markers: None; the instructions do not specify the use of delimiters to isolate API content from the agent's internal logic. Capability inventory: Subprocess execution for gmgn-cli and openssl, along with file system writes to ~/.config/gmgn/.env. Sanitization: None; the skill does not define validation or escaping for the fields retrieved from the remote API.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 23, 2026, 02:49 PM