GMGN Skill Swap

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:14 AM UTC
• Version: 1.4.6

Overview

This trading skill is mostly explicit about its purpose, but it asks an agent to install and use a global CLI with persistent raw trading credentials that can move real funds.

Review this carefully before installing. Use only a low-value wallet, rotate credentials if setup was already run, prefer an externally managed secret store or wallet flow instead of plaintext key files, and avoid global unpinned CLI installs for tools that can trade funds.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:77

Finding

Unpinned Global Installation of a Security-Critical Third-Party CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:77-79
Vulnerability Type: Unpinned third-party dependency with global installation
Risk Level: Medium

Vulnerable Code

markdown

`GMGN_API_KEY` must be configured in `~/.config/gmgn/.env`. `GMGN_PRIVATE_KEY` is additionally required for `swap` and all `order` subcommands. The private key must correspond to the wallet bound to the API Key.

- `gmgn-cli` installed globally — if missing, run: `npm install -g gmgn-cli`

Technical Analysis

The Skill directs the agent to install the latest available gmgn-cli package globally without pinning a reviewed version or verifying package integrity. No lockfile, checksum, signature, or locally auditable implementation is included in the project.

This dependency is security-critical because the documentation states that it reads GMGN_API_KEY and GMGN_PRIVATE_KEY, performs local signing, communicates with GMGN, and submits irreversible financial transactions. A compromised npm package, maintainer account, dependency, or future release would therefore execute with the user's npm permissions while having access to trading credentials.

Global installation also increases exposure because the package and its executable remain available outside the immediate Skill invocation.

Attack Path

1. An attacker compromises the npm package, one of its transitive dependencies, or the publisher account.
2. A malicious version becomes the version selected by the unpinned installation command.
3. The Skill runs npm install -g gmgn-cli.
4. Package installation hooks or the resulting CLI execute attacker-controlled code with the user's permissions.
5. The malicious code reads ~/.config/gmgn/.env, changes transaction parameters, leaks credentials, or submits unauthorized transactions.
6. The linked wallet may suffer irreversible financial loss.

Impact Assessment

Successful exploitation can provide arbitrary c ...[truncated 450 chars]

Remediation

View remediation

Remediation Suggestions

• Pin gmgn-cli to an exact, reviewed version rather than installing the latest release.
• Verify package provenance and integrity using a trusted registry, package signatures where available, and a recorded integrity hash.
• Maintain a lockfile or equivalent reviewed dependency manifest.
• Avoid global installation; use a project-local dependency invoked through a controlled wrapper.
• Disable or tightly control npm lifecycle scripts where operationally possible.
• Execute the CLI in a restricted environment with access only to the credentials and network destinations required for the requested operation.
• Re-audit the CLI and its dependency tree before upgrades.
• Prefer a bundled, auditable implementation when the tool is trusted with credentials capable of moving real funds.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:105

Finding

Private Signing Key Written to a Predictable Temporary File Without Cleanup

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:105-119
Vulnerability Type: Unsafe temporary-file and plaintext credential handling
Risk Level: Medium

Vulnerable Code

markdown

**First-time setup** (if credentials are not configured):

1. Generate key pair and show the public key to the user:
   ```bash
   openssl genpkey -algorithm ed25519 -out /tmp/gmgn_private.pem 2>/dev/null && \
     openssl pkey -in /tmp/gmgn_private.pem -pubout 2>/dev/null
   ```

2. Wait for the user's API key, then configure both credentials:
   ```bash
   mkdir -p ~/.config/gmgn
   echo 'GMGN_API_KEY=<key_from_user>' > ~/.config/gmgn/.env
   echo 'GMGN_PRIVATE_KEY="<pem_content_from_step_1>"' >> ~/.config/gmgn/.env
   chmod 600 ~/.config/gmgn/.env
   ```

Technical Analysis

The private Ed25519 key is created at the fixed, predictable path /tmp/gmgn_private.pem. The instructions do not establish a restrictive umask, use an exclusively created temporary directory, explicitly set the temporary key's mode immediately, or remove the file after copying its contents into the persistent credential file.

Although OpenSSL commonly creates private-key files with restrictive permissions, the Skill does not explicitly enforce or verify that property across supported environments. More importantly, the key remains as an unnecessary second plaintext copy in a shared temporary namespace.

The destination file is eventually changed to mode 600, but the parent directory's permissions are not explicitly restricted and the credential contents are first written before the final chmod. Plaintext .env storage also exposes the key to any process running as the same user. Because the key can sign requests that execute trades, its confidentiality is security-critical.

Attack Path

1. The Skill generates a private key at the known path /tmp/gmgn_private.pem.
2. The key remains there after credential setup becaus ...[truncated 1164 chars]

Remediation

View remediation

Remediation Suggestions

• Set umask 077 before creating any directory or file containing credentials.
• Create the key directly inside a private directory with mode 700, rather than in the shared /tmp namespace.
• If temporary storage is unavoidable, use mktemp -d, validate ownership, and create files atomically with exclusive semantics.
• Set and verify mode 600 immediately after key creation.
• Add an exit trap that removes temporary key material on success, failure, interruption, and termination.
• Explicitly set ~/.config/gmgn to mode 700 before writing the .env file.
• Write the final credential file atomically with mode 600, rather than applying permissions only after all secret content has been written.
• Prefer an operating-system keychain, hardware-backed key store, or dedicated secret manager instead of a plaintext .env file.
• Ensure commands and error output never print the private key or API key.
• Rotate both credentials if the temporary file may have been exposed.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

Writing the API key directly into a plaintext .env file causes the agent to handle and persist live trading credentials on disk. In the context of a financial execution skill, compromise of this file could enable unauthorized order placement or account abuse tied to the user's wallet.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

2. Wait for the user's API key, then configure both credentials:

   bash

   mkdir -p ~/.config/gmgn
   echo 'GMGN_API_KEY=<key_from_user>' > ~/.config/gmgn/.env
   echo 'GMGN_PRIVATE_KEY="<pem_content_from_step_1>"' >> ~/.config/gmgn/.env
   chmod 600 ~/.config/gmgn/.env
   

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

Persisting the GMGN private key in a plaintext .env file is highly dangerous because that key authorizes signing for trade-related actions. If the host, logs, backups, or workspace are exposed, an attacker could potentially sign or submit unauthorized financial operations, making this especially severe in a live trading skill.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

bash

   mkdir -p ~/.config/gmgn
   echo 'GMGN_API_KEY=<key_from_user>' > ~/.config/gmgn/.env
   echo 'GMGN_PRIVATE_KEY="<pem_content_from_step_1>"' >> ~/.config/gmgn/.env
   chmod 600 ~/.config/gmgn/.env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

Although chmod 600 reduces exposure, the surrounding pattern still normalizes the presence of highly sensitive credentials in a plaintext .env file under an agent-accessible directory. The line is part of a credential persistence workflow that increases the blast radius of any local compromise, misconfiguration, or accidental disclosure.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

mkdir -p ~/.config/gmgn echo 'GMGN_API_KEY=<key_from_user>' > ~/.config/gmgn/.env echo 'GMGN_PRIVATE_KEY="<pem_content_from_step_1>"' >> ~/.config/gmgn/.env chmod 600 ~/.config/gmgn/.env

text

### Credential Model

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to inspect local network interfaces and perform an external IP test to diagnose IPv6 routing. That exceeds the minimum scope needed for a trading skill and encourages host/network reconnaissance, potentially exposing sensitive environment details or normalizing unrelated system inspection during financial workflows.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

- Every `swap` and `order strategy create` command submits an on-chain transaction that moves real funds.
- Transactions cannot be undone once confirmed on-chain.
- The AI agent must **never auto-execute a swap** — explicit user confirmation is required every time, without exception.
- Only use this skill with funds you are willing to trade. Start with small amounts when testing.

## Sub-commands

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup flow has the agent generate a signing keypair locally and persist the private key in a config file. For a financial execution skill, this materially expands the trust boundary: the agent is now creating, handling, and storing secrets that can authorize trades, making compromise or mishandling far more damaging.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The skill directs the agent to create a persistent config directory and save reusable credentials across sessions. In a financial automation context, this creates durable authorization state that can survive beyond the original task, increasing the risk of later misuse, unintended reuse, or compromise by other processes or future prompts.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

2. Wait for the user's API key, then configure both credentials:

   bash

   mkdir -p ~/.config/gmgn
   echo 'GMGN_API_KEY=<key_from_user>' > ~/.config/gmgn/.env
   echo 'GMGN_PRIVATE_KEY="<pem_content_from_step_1>"' >> ~/.config/gmgn/.env
   chmod 600 ~/.config/gmgn/.env
   

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

mkdir -p ~/.config/gmgn echo 'GMGN_API_KEY=<key_from_user>' > ~/.config/gmgn/.env echo 'GMGN_PRIVATE_KEY="<pem_content_from_step_1>"' >> ~/.config/gmgn/.env chmod 600 ~/.config/gmgn/.env

text

### Credential Model

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes this skill as a financial execution tool for swaps, batch trades, and order management via GMGN API, but the file also requires running gmgn-cli token security and interpreting is_honeypot and rug_ratio before swaps. That adds a token-analysis/safety-screening capability not reflected in the manifest description or argument hints.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 812)May include surrounding context.

md

## Execution Guidelines

- **[REQUIRED] Token security check** — Run before every swap. See **Pre-Swap Safety Check (REQUIRED)** section above. Uses exist auth (API Key only — no private key needed for this step).
- **Currency resolution** — When the user names a currency (SOL/BNB/ETH/USDC) instead of providing an address, look up its address in the Chain Currencies table and apply it automatically — never ask the user for it.
  - Buy ("buy X SOL of TOKEN", "spend 0.5 USDC on TOKEN") → resolve currency to `--input-token`
  - Sell ("sell TOKEN for SOL", "sell 50% of TOKEN to USDC") → resolve currency to `--output-token`
- **[REQUIRED] Pre-trade confirmation** — Before executing `swap`, you MUST present a summary of the trade to the user and receive explicit confirmation. This is a hard rule with no exceptions — do NOT proceed if the user has not confirmed. Display: chain, wallet (`--from`), input token + amount, output token, slippage, and estimated fees.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Line L009 says not to use web access or visit gmgn.ai and that all swap operations must go through the CLI, yet L013 instructs an external HTTP test to ipv6.icanhazip.com, and L112 tells the user to go to https://gmgn.ai/ai for setup. This creates an intent/documentation inconsistency about whether non-CLI web interaction is allowed in the workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.