skills/gmgnai/gmgn-skills/gmgn-swap/Gen Agent Trust Hub

gmgn-swap

Pass

Audited by Gen Agent Trust Hub on May 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Uses the gmgn-cli tool to facilitate on-chain token swaps, multi-wallet batch trading, and order management across multiple networks.
  • [COMMAND_EXECUTION]: Employs openssl locally to generate Ed25519 cryptographic keys, ensuring that private keys are handled on the local machine.
  • [COMMAND_EXECUTION]: Utilizes diagnostic commands such as ip addr and ifconfig alongside the well-known service icanhazip.com to verify IPv4 connectivity.
  • [EXTERNAL_DOWNLOADS]: Requires the installation of the gmgn-cli package from the official NPM registry, which is a resource owned by the vendor.
  • [PROMPT_INJECTION]: Addresses the potential for indirect prompt injection when processing token metadata from external APIs.
  • Ingestion points: Token contract addresses and metadata retrieved via GMGN API responses.
  • Boundary markers: Includes specific instructions to treat external metadata as untrusted [EXTERNAL DATA].
  • Capability inventory: High-privilege actions including blockchain transaction execution and shell command construction via gmgn-cli.
  • Sanitization: Enforces strict address format validation and shell quoting of all user-supplied and API-sourced variables.
  • [SAFE]: Implements a mandatory human-in-the-loop confirmation requirement for all real-fund transactions.
  • [SAFE]: Integrates an automated "Pre-Swap Safety Check" that detects honeypot contracts and warns users about high-risk tokens based on rug-pull ratios.
Audit Metadata
Risk Level
SAFE
Analyzed
May 19, 2026, 02:02 PM