gmgn-market
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external, untrusted data from the GMGN API, including token names, symbols, and project descriptions which are controlled by third-party blockchain participants. Maliciously crafted token metadata could attempt to influence the agent's behavior.
- Ingestion points: Output from
gmgn-cli marketsub-commands inSKILL.md. - Boundary markers: Absent; the instructions do not define delimiters for external content returned by the CLI.
- Capability inventory: The skill allows shell command execution via
gmgn-cli,ifconfig,ip addr, anddate. - Sanitization: Absent; the instructions direct the agent to use and summarize fields like
symbolandnamedirectly from the API response. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
gmgn-cliutility vianpm install -g gmgn-cli. This is a standard requirement for CLI-based skills and targets the author's own package. - [COMMAND_EXECUTION]: The skill utilizes local shell commands including
datefor Unix timestamp calculation, andifconfigorip addr showfor network troubleshooting. These are used for their intended purposes within the provided examples and troubleshooting sections.
Audit Metadata