skills/gmgnai/gmgn-skills/gmgn-market/Gen Agent Trust Hub

gmgn-market

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external, untrusted data from the GMGN API, including token names, symbols, and project descriptions which are controlled by third-party blockchain participants. Maliciously crafted token metadata could attempt to influence the agent's behavior.
  • Ingestion points: Output from gmgn-cli market sub-commands in SKILL.md.
  • Boundary markers: Absent; the instructions do not define delimiters for external content returned by the CLI.
  • Capability inventory: The skill allows shell command execution via gmgn-cli, ifconfig, ip addr, and date.
  • Sanitization: Absent; the instructions direct the agent to use and summarize fields like symbol and name directly from the API response.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the gmgn-cli utility via npm install -g gmgn-cli. This is a standard requirement for CLI-based skills and targets the author's own package.
  • [COMMAND_EXECUTION]: The skill utilizes local shell commands including date for Unix timestamp calculation, and ifconfig or ip addr show for network troubleshooting. These are used for their intended purposes within the provided examples and troubleshooting sections.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 03:52 PM
Security Audit — agent-trust-hub — gmgn-market