gmgn-track
Pass
Audited by Gen Agent Trust Hub on Apr 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes several local shell commands, including openssl for Ed25519 key generation, and ifconfig or ip addr for IPv6 connectivity diagnostics during troubleshooting.
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the gmgn-cli global Node.js package, which is the primary tool for interacting with the GMGN tracking API.
- [PROMPT_INJECTION]: The skill processes external blockchain trade data (such as wallet names and token symbols) from the GMGN API, creating a vulnerability surface for indirect prompt injection. Ingestion points: Trade records fetched via gmgn-cli track sub-commands. Boundary markers: None; the instructions do not specify the use of delimiters to isolate API content from the agent's internal logic. Capability inventory: Subprocess execution for gmgn-cli and openssl, along with file system writes to ~/.config/gmgn/.env. Sanitization: None; the skill does not define validation or escaping for the fields retrieved from the remote API.
Audit Metadata