gmgn-wallet-analysis
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Python
subprocessmodule to rungmgn-clifor data retrieval and performs network diagnostics usingifconfigandip addr. The implementation follows secure practices by passing arguments as a list rather than a shell string, mitigating potential command injection vulnerabilities. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external blockchain data (token names, wallet tags) which presents an indirect injection surface.
- Ingestion points: Data is ingested into the agent context through the outputs of the
analyze.pyscript and thegmgn-clitool. - Boundary markers:
SKILL.mdprovides clear instructions to the AI agent to treat all third-party string fields as data only and to ignore any instructions embedded within them. - Capability inventory: The skill has capabilities to execute local CLI tools and provide detailed textual analysis.
- Sanitization: The skill relies on natural language boundary markers and agent-level instructions to sanitize potentially malicious metadata.
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
gmgn-cliutility via npm. Since this is the official tool provided by the vendorgmgnai, it is documented as a standard functional dependency.
Audit Metadata