gmgn-token-buy

SUSPICIOUS. The skill is mostly coherent with its stated purpose as a GMGN token-buy workflow and avoids obvious exfiltration or hidden execution, but it depends on an external CLI and forwards API credentials into that tool, plus it participates in autonomous crypto-trading preparation with downstream execution. Same-org npm/docs evidence lowers concern from malicious to medium-risk developer-tooling trust.