gmgn-wallet-analysis

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Python subprocess module to run gmgn-cli for data retrieval and performs network diagnostics using ifconfig and ip addr. The implementation follows secure practices by passing arguments as a list rather than a shell string, mitigating potential command injection vulnerabilities.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external blockchain data (token names, wallet tags) which presents an indirect injection surface.
  • Ingestion points: Data is ingested into the agent context through the outputs of the analyze.py script and the gmgn-cli tool.
  • Boundary markers: SKILL.md provides clear instructions to the AI agent to treat all third-party string fields as data only and to ignore any instructions embedded within them.
  • Capability inventory: The skill has capabilities to execute local CLI tools and provide detailed textual analysis.
  • Sanitization: The skill relies on natural language boundary markers and agent-level instructions to sanitize potentially malicious metadata.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the gmgn-cli utility via npm. Since this is the official tool provided by the vendor gmgnai, it is documented as a standard functional dependency.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 11:22 AM