The Agent Skills Directory

[COMMAND_EXECUTION]: The analyze.py script utilizes the subprocess.run function to interact with the gmgn-cli tool. The implementation is secure as it passes arguments (such as wallet addresses and chain identifiers) as a list rather than a shell string, which effectively mitigates shell injection risks. The diagnostic commands mentioned in the instructions (ifconfig, ip addr) are standard, non-privileged operations used for connectivity troubleshooting.
[EXTERNAL_DOWNLOADS]: The skill directs users to install gmgn-cli via the official npm registry. Additionally, the documentation suggests using icanhazip.com for IPv6 diagnostics. Both sources are well-known and reputable within the developer community, posing no inherent security risk in this context.
[INDIRECT_PROMPT_INJECTION]: The skill processes structured data from external API responses via gmgn-cli. To mitigate the risk of data poisoning or formatting disruption, the script includes a sanitization function (esc) that escapes markdown-specific characters (like pipes) before generating the final report. This ensures that the agent's output remains structurally sound even when processing untrusted input.
Ingestion points: Data retrieved through gmgn-cli portfolio commands in analyze.py.
Boundary markers: The final report uses distinct markdown headers and tables to isolate different data segments.
Capability inventory: The script is limited to local command execution (gmgn-cli) and standard library data processing; it does not perform direct file writing or outbound network requests itself.
Sanitization: The esc() function provides necessary character escaping for markdown table safety.
[CREDENTIALS_UNSAFE]: The skill manages authentication tokens and private keys required by the GMGN platform by instructing users to use the CLI's built-in configuration command (gmgn-cli config). This follows standard security practices for command-line tools and avoids the use of hardcoded secrets or unsafe storage methods.

gmgn-wallet-analysis