GMGN Skill Token

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:20 AM UTC
• Version: 1.4.6

Overview

The skill mostly does token research as advertised, but its setup path asks the agent to install a global npm tool and handle persistent API credentials and key material on disk.

Review before installing. This skill is not shown to steal data or perform destructive actions, but only use it if you are comfortable with a global npm dependency, GMGN API requests, local API-key storage, and setup commands that create key material. Prefer preinstalling a reviewed/pinned gmgn-cli yourself and configuring secrets through a trusted secret store or manual setup outside the agent.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:49

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Remediation

View remediation

``` 2. Record and verify the package-lock integrity metadata or a separately published cryptographic checksum. 3. Prefer a project-local installation and invoke the pinned executable from that isolated environment instead of using `-g`. 4. Run the package in a sandbox or container with access limited to the required GMGN credential and network endpoint. 5. Disable npm lifecycle scripts where the package supports installation without them: ```bash npm install --ignore-scripts --save-exact gmgn-cli@ ``` 6. Verify the package name, publisher, provenance attestations, and official distribution channel before installation. 7. Document a controlled update process requiring security review before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:73

Finding

Private Key Written to a Predictable Temporary Path Without Cleanup

Content

View full analysis

/dev/null && \ openssl pkey -in /tmp/gmgn_private.pem -pubout 2>/dev/null ``` ### Technical Analysis The first-time setup procedure writes an Ed25519 private key to the fixed path `/tmp/gmgn_private.pem`. Shared temporary directories are commonly writable by multiple local users and processes. A predictable filename creates opportunities for pre-creation, symbolic-link manipulation, monitoring, or later retrieval, depending on operating-system protections and OpenSSL file-opening behavior. The procedure does not: - Create a private temporary directory with an unpredictable name. - Set a restrictive `umask` before generating the key. - Explicitly reject an existing file or symbolic link. - Register cleanup handling. - Delete the private key after deriving and displaying its public key. Consequently, sensitive private-key material may remain on disk after enrollment. Although the API requests are described as using an API key rather than signatures, retaining an apparently unused enrollment private key still creates unnecessary secret exposure. ### Attack Path A representative local attack path is: 1. An attacker with access to the same host observes that the Skill uses the predictable path `/tmp/gmgn_private.pem`. 2. Before setup, the attacker prepares or monitors that path. Where platform protections permit, the attacker may attempt a symbolic-link or file-replacement attack. 3. The Agent executes the documented OpenSSL command. 4. Private-key material is written to or becomes observable at the known path. 5. Because no cleanup command or trap is present, the file remains after the public key is displayed. 6. The attacker reads the retained key if file ownership, permissions, ba ...[truncated 1076 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The first-time setup block instructs the agent to generate cryptographic keys and persist an API key into the user's home directory. For a research skill, this is unnecessary privilege expansion into secret handling and filesystem mutation, creating risk of credential mishandling, persistence of sensitive data, and abuse if the skill is triggered unexpectedly.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The skill explicitly instructs the agent to receive a user API key and write it into a plaintext .env file. This is credential handling beyond the declared purpose and creates a durable secret on disk that could be exposed via logs, backups, other tools, or later compromise of the account.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

2. Wait for the user's API key, then configure:

   bash

   mkdir -p ~/.config/gmgn
   echo 'GMGN_API_KEY=<key_from_user>' > ~/.config/gmgn/.env
   chmod 600 ~/.config/gmgn/.env
   

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

Although the chmod line itself tightens permissions, in context it participates in a workflow that persists credentials to a local .env file. That file-based secret storage expands the agent's access to credentials and can normalize unsafe handling of API tokens in a skill that should only perform token lookups.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

bash

   mkdir -p ~/.config/gmgn
   echo 'GMGN_API_KEY=<key_from_user>' > ~/.config/gmgn/.env
   chmod 600 ~/.config/gmgn/.env

Parameters — token info / token security / token pool

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs the agent to inspect local network interfaces and call an unrelated external IP-discovery service to diagnose IPv6 routing. That exceeds the token-research scope and unnecessarily exposes host/network metadata, increasing the chance of privacy leakage and environment probing from a nominally read-only skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instruction to install gmgn-cli with npm introduces package installation and system modification behavior that is broader than the stated read-only token lookup purpose. Allowing an agent skill to perform package management increases supply-chain and host-integrity risk, especially if triggered in environments where dependencies should be fixed and pre-approved.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

Creating ~/.config/gmgn and saving configuration there establishes persistent state across sessions for a skill whose described function is transient token research. Persistence increases blast radius because secrets and tool state remain available to future runs, unrelated prompts, or post-compromise activity.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

2. Wait for the user's API key, then configure:

   bash

   mkdir -p ~/.config/gmgn
   echo 'GMGN_API_KEY=<key_from_user>' > ~/.config/gmgn/.env
   chmod 600 ~/.config/gmgn/.env
   

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

bash

   mkdir -p ~/.config/gmgn
   echo 'GMGN_API_KEY=<key_from_user>' > ~/.config/gmgn/.env
   chmod 600 ~/.config/gmgn/.env

Parameters — token info / token security / token pool