ClawHub
Back to skill

Security audit

GMGN Skill Swap

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate-looking GMGN trading skill, but it needs Review because it can execute real crypto trades and asks the agent to collect and persist trading credentials.

Install only if you intentionally want an agent to trade through GMGN with real funds. Use a low-balance wallet, configure secrets outside chat when possible, verify ~/.config/gmgn/.env permissions, remove any temporary private-key file after setup, and require explicit confirmation for every swap, multi-swap, and strategy order.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill mandates use of a `gmgn-cli token security` command that is not declared in the skill's stated command scope. That creates scope drift: an agent may attempt undocumented capability expansion, weakening reviewability and increasing the chance of invoking unintended tooling or fallback behaviors during a financial workflow.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to inspect local network interfaces and query an external IP-check service to troubleshoot IPv6. This exceeds the minimum privileges needed for token trading and unnecessarily grants visibility into local system/network state while also causing unsolicited outbound traffic to a third party.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The setup flow tells the agent to generate a private key and write both API and private-key material into the user's filesystem. This materially expands the skill from trade execution into credential provisioning and secret persistence, increasing the blast radius if the agent mishandles files, logs, or subsequent commands.

Ssd 3

Medium
Confidence
99% confidence
Finding
The setup asks the user to paste an API key back into chat, creating a plain-language credential collection channel. Secrets transmitted through conversational interfaces may be retained in logs, transcripts, analytics, or exposed to other tools, and the same flow then persists them locally.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.