GMGN Skill Token

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:20 AM UTC
• Version: 1.4.6

Overview

The skill mostly does token research as advertised, but its setup path asks the agent to install a global npm tool and handle persistent API credentials and key material on disk.

Review before installing. This skill is not shown to steal data or perform destructive actions, but only use it if you are comfortable with a global npm dependency, GMGN API requests, local API-key storage, and setup commands that create key material. Prefer preinstalling a reviewed/pinned gmgn-cli yourself and configuring secrets through a trusted secret store or manual setup outside the agent.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:49
• Finding: Unpinned Global Installation of a Third-Party npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:49` **Vulnerability Type**: Unpinned third-party dependency with global installation scope **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g gmgn-cli ``` ### Technical Analysis The Skill instructs the Agent to install the latest available version of `gmgn-cli` from npm without specifying an audited version or validating package integrity. Because npm package contents can change after the Skill has been reviewed, the code ultimately executed is not fixed by this repository. npm packages can run lifecycle scripts during installation. The `-g` option also installs the package globally for the current environment, giving the installation broader filesystem scope and making the resulting executable available to later sessions and unrelated tasks. This exceeds the minimum scope needed for an isolated token-information query. The audit found no evidence that the current `gmgn-cli` package is malicious. The vulnerability is the unsafe and mutable dependency acquisition mechanism. ### Attack Path 1. An attacker compromises the npm publisher account, package repository, or release pipeline for `gmgn-cli`. 2. The attacker publishes a malicious version under the same package name. 3. An Agent loading this Skill finds that the CLI is absent and follows the prerequisite instruction. 4. `npm install -g gmgn-cli` downloads the latest compromised release without version or integrity verification. 5. Malicious lifecycle code can execute during installation with the privileges of the Agent process. 6. The globally installed executable can subsequently run whenever the Skill invokes `gmgn-cli`, potentially extending the compromise beyond the installation step. ### Impact Assessment Successful exploitation could execute arbitrary code with the permissions of the user running the Agent. Depending on that user's accessible resources, attacker code could: - Read user-accessible files and credent ...[truncated 458 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `gmgn-cli` to an exact version that has been reviewed, rather than installing the mutable latest release: ```bash npm install --save-exact gmgn-cli@<audited-version> ``` 2. Record and verify the package-lock integrity metadata or a separately published cryptographic checksum. 3. Prefer a project-local installation and invoke the pinned executable from that isolated environment instead of using `-g`. 4. Run the package in a sandbox or container with access limited to the required GMGN credential and network endpoint. 5. Disable npm lifecycle scripts where the package supports installation without them: ```bash npm install --ignore-scripts --save-exact gmgn-cli@<audited-version> ``` 6. Verify the package name, publisher, provenance attestations, and official distribution channel before installation. 7. Document a controlled update process requiring security review before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:73
• Finding: Private Key Written to a Predictable Temporary Path Without Cleanup<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:73-76` **Vulnerability Type**: Unsafe temporary file handling for private cryptographic material **Risk Level**: Medium ### Vulnerable Code ```bash openssl genpkey -algorithm ed25519 -out /tmp/gmgn_private.pem 2>/dev/null && \ openssl pkey -in /tmp/gmgn_private.pem -pubout 2>/dev/null ``` ### Technical Analysis The first-time setup procedure writes an Ed25519 private key to the fixed path `/tmp/gmgn_private.pem`. Shared temporary directories are commonly writable by multiple local users and processes. A predictable filename creates opportunities for pre-creation, symbolic-link manipulation, monitoring, or later retrieval, depending on operating-system protections and OpenSSL file-opening behavior. The procedure does not: - Create a private temporary directory with an unpredictable name. - Set a restrictive `umask` before generating the key. - Explicitly reject an existing file or symbolic link. - Register cleanup handling. - Delete the private key after deriving and displaying its public key. Consequently, sensitive private-key material may remain on disk after enrollment. Although the API requests are described as using an API key rather than signatures, retaining an apparently unused enrollment private key still creates unnecessary secret exposure. ### Attack Path A representative local attack path is: 1. An attacker with access to the same host observes that the Skill uses the predictable path `/tmp/gmgn_private.pem`. 2. Before setup, the attacker prepares or monitors that path. Where platform protections permit, the attacker may attempt a symbolic-link or file-replacement attack. 3. The Agent executes the documented OpenSSL command. 4. Private-key material is written to or becomes observable at the known path. 5. Because no cleanup command or trap is present, the file remains after the public key is displayed. 6. The attacker reads the retained key if file ownership, permissions, ba ...[truncated 1076 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Set a restrictive process mask before creating any secret: ```bash umask 077 ``` 2. Create an unpredictable private temporary directory: ```bash tmpdir="$(mktemp -d)" || exit 1 chmod 700 "$tmpdir" ``` 3. Register cleanup immediately and remove the directory on normal exit or interruption: ```bash trap 'rm -rf -- "$tmpdir"' EXIT HUP INT TERM ``` 4. Generate the key inside that directory: ```bash openssl genpkey -algorithm ed25519 -out "$tmpdir/gmgn_private.pem" && openssl pkey -in "$tmpdir/gmgn_private.pem" -pubout ``` 5. Ensure setup refuses pre-existing destinations and does not follow attacker-controlled symbolic links. 6. Delete the private key immediately after enrollment if it is not needed for later authentication. 7. If continued possession is required, store the key in an operating-system credential store or a dedicated mode-`0700` directory with a mode-`0600` key file, rather than under `/tmp`. 8. Document why the private key is generated and whether it must be retained, rotated, or revoked. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The first-time setup block instructs the agent to generate cryptographic keys and persist an API key into the user's home directory. For a research skill, this is unnecessary privilege expansion into secret handling and filesystem mutation, creating risk of credential mishandling, persistence of sensitive data, and abuse if the skill is triggered unexpectedly.

Credential Access

High

• Category: Privilege Escalation

Content

2. Wait for the user's API key, then configure:
   ```bash
   mkdir -p ~/.config/gmgn
   echo 'GMGN_API_KEY=<key_from_user>' > ~/.config/gmgn/.env
   chmod 600 ~/.config/gmgn/.env
   ```

• Confidence: 98% confidence
• Finding: The skill explicitly instructs the agent to receive a user API key and write it into a plaintext .env file. This is credential handling beyond the declared purpose and creates a durable secret on disk that could be exposed via logs, backups, other tools, or later compromise of the account.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
   mkdir -p ~/.config/gmgn
   echo 'GMGN_API_KEY=<key_from_user>' > ~/.config/gmgn/.env
   chmod 600 ~/.config/gmgn/.env
   ```

## Parameters — `token info` / `token security` / `token pool`

• Confidence: 97% confidence
• Finding: Although the chmod line itself tightens permissions, in context it participates in a workflow that persists credentials to a local .env file. That file-based secret storage expands the agent's access to credentials and can normalize unsafe handling of API tokens in a skill that should only perform token lookups.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill directs the agent to inspect local network interfaces and call an unrelated external IP-discovery service to diagnose IPv6 routing. That exceeds the token-research scope and unnecessarily exposes host/network metadata, increasing the chance of privacy leakage and environment probing from a nominally read-only skill.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The instruction to install gmgn-cli with npm introduces package installation and system modification behavior that is broader than the stated read-only token lookup purpose. Allowing an agent skill to perform package management increases supply-chain and host-integrity risk, especially if triggered in environments where dependencies should be fixed and pre-approved.

Session Persistence

Medium

• Category: Rogue Agent

Content

2. Wait for the user's API key, then configure:
   ```bash
   mkdir -p ~/.config/gmgn
   echo 'GMGN_API_KEY=<key_from_user>' > ~/.config/gmgn/.env
   chmod 600 ~/.config/gmgn/.env
   ```

• Confidence: 96% confidence
• Finding: Creating ~/.config/gmgn and saving configuration there establishes persistent state across sessions for a skill whose described function is transient token research. Persistence increases blast radius because secrets and tool state remain available to future runs, unrelated prompts, or post-compromise activity.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
   mkdir -p ~/.config/gmgn
   echo 'GMGN_API_KEY=<key_from_user>' > ~/.config/gmgn/.env
   chmod 600 ~/.config/gmgn/.env
   ```

## Parameters — `token info` / `token security` / `token pool`

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.