GMGN Skill Portfolio

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:15 AM UTC
• Version: 1.4.7

Overview

The skill has a legitimate wallet-analysis purpose, but it asks the agent to install an unpinned global CLI and handle persistent API/private keys in unsafe ways.

Review before installing. Use this skill only in an environment where you are comfortable installing gmgn-cli and exposing GMGN wallet-analysis data. Avoid sending API keys in chat; prefer a secure secret store or a non-logged prompt, pin and verify the CLI before installation, and rotate/delete any GMGN keys if they were written to local files or temporary paths.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:50

Finding

Unpinned Global Installation of an Unaudited npm Package

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:87

Finding

API Key Exposure Through Chat and Unsafe Shell Interpolation

Content

View full analysis

' > ~/.config/gmgn/.env chmod 600 ~/.config/gmgn/.env ``` ``` ### Technical Analysis The setup procedure asks the user to transmit an API key through the conversation. This can expose the secret to conversation history, model context, Agent telemetry, command transcripts, or other logging systems. The placeholder `` is also shown as direct content inside a shell command. If the Agent substitutes the user-provided value into this command without robust shell escaping, a single quote in the supplied value can terminate the quoted string. Shell metacharacters following it may then be interpreted as commands. For example, a malicious value conceptually shaped as the following could escape the quoted argument: ```text '; attacker_command; # ``` The subsequent `chmod 600` is a useful file-permission control, but it occurs only after the shell command is evaluated. It therefore does not prevent command injection or disclosure through the conversation and execution logs. ### Attack Path 1. The Skill asks a user or other conversation participant to provide the API key. 2. An attacker supplies a crafted value containing a single quote and shell syntax. 3. The Agent replaces `` with that value in the documented command. 4. The shell terminates the intended quoted string and evaluates the injected syntax. 5. The injected command executes with the privileges and filesystem access of the Agent user. Separately, even a legitimate key can remain expo ...[truncated 598 chars]

Remediation

View remediation

"$HOME/.config/gmgn/.env" unset GMGN_API_KEY chmod 600 "$HOME/.config/gmgn/.env" ``` - Prefer a configuration API that accepts secret data through standard input or a protected file descriptor. - Redact secrets from Agent logs, telemetry, error messages, and command transcripts. - Validate that the key conforms to the documented API-key format, but do not rely on validation as a substitute for safe argument handling. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:82

Finding

Private Key Stored at a Predictable Temporary Path Without Cleanup

Content

View full analysis

/dev/null && \ openssl pkey -in /tmp/gmgn_private.pem -pubout 2>/dev/null ``` ``` ### Technical Analysis The procedure writes an Ed25519 private key to the fixed path `/tmp/gmgn_private.pem`. Shared temporary directories are inappropriate for persistent secret material unless the file is created using secure, exclusive semantics and restrictive permissions. The Skill does not: - Set a restrictive `umask` before key generation. - Create a unique private temporary directory. - Check whether the destination already exists or is a symbolic link. - Explicitly verify restrictive permissions after creation. - Remove the key after its intended use. - Explain how the CLI securely obtains or stores the generated private key. A predictable path creates collision and potential symlink risks in multi-user or shared execution environments. The lack of cleanup also leaves sensitive key material on disk longer than required. Actual exploitability depends on host permissions and OpenSSL's file-creation behavior, but the procedure does not establish the necessary protections. ### Attack Path 1. A local attacker predicts the fixed path `/tmp/gmgn_private.pem`. 2. In a shared environment, the attacker monitors or attempts to interfere with that path before key generation. 3. The Agent runs the documented OpenSSL command. 4. The private key is created at the predictable location and remains there after the public key is displayed. 5. If local permissions, path handling, or a pre-created filesystem object permit access or redirection, the attacker obtains or interferes with the private key. A later process may also recover residual key mate ...[truncated 511 chars]

Remediation

View remediation

other

Note

• Location: SKILL.md:11

Finding

Unnecessary Host-Network Enumeration and Third-Party IP Disclosure

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

Writing the API key directly into ~/.config/gmgn/.env causes the agent to handle and persist credentials in plaintext on disk. This is a credential exposure risk because local files can be exfiltrated, copied into backups, inspected by other software, or inadvertently reused outside the intended GMGN context.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

2. Wait for the user's API key, then configure:

   bash

   mkdir -p ~/.config/gmgn
   echo 'GMGN_API_KEY=<key_from_user>' > ~/.config/gmgn/.env
   chmod 600 ~/.config/gmgn/.env
   

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

bash

   mkdir -p ~/.config/gmgn
   echo 'GMGN_API_KEY=<key_from_user>' > ~/.config/gmgn/.env
   chmod 600 ~/.config/gmgn/.env

Usage Examples

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description is broad enough to trigger on many generic wallet-analysis requests, causing the skill to activate in situations where secret-dependent CLI behavior or setup instructions may be unnecessary. Overbroad invocation increases the chance the agent enters credential-handling or local-command paths for routine user questions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill includes setup steps that go beyond passive wallet analysis by instructing the agent to generate cryptographic key material and persist API credentials locally. Even if intended for onboarding, this expands the skill’s privilege scope and creates opportunities for secret handling mistakes, leakage, or misuse unrelated to the user’s immediate request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup flow tells the agent to store an API key in a local .env file without warning the user about secret persistence, local exposure, backup/sync risks, or host trust boundaries. Persisting secrets silently on disk is dangerous because they may be recoverable by other processes, logs, shell history, backups, or future sessions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Creating a persistent configuration directory and storing credentials there enables session-to-session secret retention beyond the immediate task. Persistent state increases blast radius because a later compromise, unrelated skill, or unintended reuse can access the same stored credential material.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

2. Wait for the user's API key, then configure:

   bash

   mkdir -p ~/.config/gmgn
   echo 'GMGN_API_KEY=<key_from_user>' > ~/.config/gmgn/.env
   chmod 600 ~/.config/gmgn/.env
   

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

bash

   mkdir -p ~/.config/gmgn
   echo 'GMGN_API_KEY=<key_from_user>' > ~/.config/gmgn/.env
   chmod 600 ~/.config/gmgn/.env

Usage Examples

Static analysis

No suspicious patterns detected.