T08 · Insecure Dependencies
Warning
- Location
SKILL.md:64- Finding
Unpinned Global npm Package Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
GMGN Skill Track
Security checks for vulnerabilities and agentic risk
Overview
The skill is meant to query GMGN crypto tracking data, but its setup handles API and signing keys in unsafe, persistent ways and installs a mutable global CLI package.
Review before installing. Prefer installing a verified, pinned gmgn-cli yourself, configure secrets outside the agent or through a secret manager, and only create a GMGN private signing key if you explicitly need follow-wallet. Treat outputs as informational crypto data, not trading advice.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:97- Finding
Shell Command Injection Through API-Key Interpolation
- Content
View full analysis
" > ~/.config/gmgn/.env echo "GMGN_PRIVATE_KEY=$(awk '{printf "%s\\n", $0}' /tmp/gmgn_private.pem)" >> ~/.config/gmgn/.env chmod 600 ~/.config/gmgn/.env rm /tmp/gmgn_private.pem ``` ### Technical Analysis The instructions require the Agent to replace `` with conversationally supplied input inside a double-quoted shell command. If the value is inserted into shell source without strict validation and escaping, shell syntax embedded in the value can alter command parsing. Potentially dangerous content includes: - Command substitutions such as `$(command)`. - Backtick command substitutions. - Double quotes that terminate the intended quoted string. - Newline characters that introduce additional shell commands or configuration entries. - Shell operators or redirections introduced after escaping the quoted context. This creates a command-injection boundary between untrusted conversational input and the local shell. Merely wrapping the placeholder in double quotes is insufficient because command substitution remains active inside double-quoted shell strings. ### Attack Path 1. An attacker or untrusted party provides a purported GMGN API key containing shell metacharacters or command-substitution syntax. 2. The Agent substitutes that value verbatim for ``. 3. The resulting command is passed to a shell. 4. The shell evaluates the injected syntax while processing the `echo` command. 5. Attacker-selected commands execute with the privileges of the Agent's operating-system account. For example, a malicious value containing command substitution could cause a command to run before the resulting text is written to the configuration file. ### Impact Assessment Successful exploitation permits arbitr ...[truncated 602 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:88- Finding
Predictable Temporary File and Excessive Private-Key Provisioning
- Content
View full analysis
/dev/null && \ openssl pkey -in /tmp/gmgn_private.pem -pubout 2>/dev/null ``` ```bash mkdir -p ~/.config/gmgn echo "GMGN_API_KEY=" > ~/.config/gmgn/.env echo "GMGN_PRIVATE_KEY=$(awk '{printf "%s\\n", $0}' /tmp/gmgn_private.pem)" >> ~/.config/gmgn/.env chmod 600 ~/.config/gmgn/.env rm /tmp/gmgn_private.pem ``` ### Technical Analysis The setup writes private key material to the fixed path `/tmp/gmgn_private.pem`. Shared temporary directories are commonly writable by multiple local users, and predictable names are susceptible to collisions and unsafe path manipulation if file creation does not enforce exclusive, non-symlink semantics. The instructions also generate and persist a signing private key during generic first-time setup even though the Skill explicitly states that this credential is required only for `track follow-wallet`. Users who request only `follow-tokens`, `kol`, or `smartmoney` therefore receive and retain a credential with capabilities beyond the minimum necessary for those operations. Although the final `.env` file is changed to mode `0600`, that permission is applied only after both credentials are written. The instructions do not set a restrictive `umask`, do not atomically create the destination with secure permissions, and store both credentials together in plaintext. ### Attack Path A local exploitation scenario is: 1. An attacker with access to the same system anticipates or observes use of `/tmp/gmgn_private.pem`. 2. The attacker ...[truncated 1365 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (10)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
This line writes the user-provided GMGN API key directly into a plaintext .env file under the agent-controlled home directory. Storing credentials in plaintext creates a durable secret that may be exposed through logs, backups, later tool access, or unrelated agent tasks.
- Content
- Wait for the user's API key, then configure (saves both API key and private key — private key is required for
track follow-wallet):bash mkdir -p ~/.config/gmgn echo "GMGN_API_KEY=<key_from_user>" > ~/.config/gmgn/.env echo "GMGN_PRIVATE_KEY=$(awk '{printf "%s\\n", $0}' /tmp/gmgn_private.pem)" >> ~/.config/gmgn/.env chmod 600 ~/.config/gmgn/.env rm /tmp/gmgn_private.pem
- Wait for the user's API key, then configure (saves both API key and private key — private key is required for
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
This line persists the generated GMGN private key into the same plaintext .env file, giving the agent workflow durable access to a signing credential. Exposure of a private key is more severe than API-key leakage because it can enable authenticated signed requests and potentially broader account compromise depending on GMGN’s trust model.
- Content
bash mkdir -p ~/.config/gmgn echo "GMGN_API_KEY=<key_from_user>" > ~/.config/gmgn/.env echo "GMGN_PRIVATE_KEY=$(awk '{printf "%s\\n", $0}' /tmp/gmgn_private.pem)" >> ~/.config/gmgn/.env chmod 600 ~/.config/gmgn/.env rm /tmp/gmgn_private.pem
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
mkdir -p ~/.config/gmgn echo "GMGN_API_KEY=<key_from_user>" > ~/.config/gmgn/.env echo "GMGN_PRIVATE_KEY=$(awk '{printf "%s\n", $0}' /tmp/gmgn_private.pem)" >> ~/.config/gmgn/.env chmod 600 ~/.config/gmgn/.env rm /tmp/gmgn_private.pem
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
echo "GMGN_API_KEY=<key_from_user>" > ~/.config/gmgn/.env echo "GMGN_PRIVATE_KEY=$(awk '{printf "%s\n", $0}' /tmp/gmgn_private.pem)" >> ~/.config/gmgn/.env chmod 600 ~/.config/gmgn/.env rm /tmp/gmgn_private.pem
text ## Usage Examples
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description contains broad activation cues such as 'alpha signals,' 'whale tracking,' and 'copy-trading ideas,' which can cause the skill to trigger in loosely related finance conversations. Over-broad invocation increases the chance the agent enters a workflow that fetches account-linked or sensitive trading data when the user did not clearly request that specific operation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The skill markets 'copy-trading ideas' and smart-money mimicry without guardrails, suitability checks, or clear user confirmation. In context, this nudges the agent toward actionable financial behavior based on influencer/whale activity, which can amplify risky or manipulative trading patterns.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill includes first-time setup steps that generate an Ed25519 private key, solicit an API key from the user, and persist both secrets locally in ~/.config/gmgn/.env. That materially exceeds a read-only tracking skill’s core purpose and creates a durable credential-handling pathway inside the agent workflow, increasing the chance of secret exposure, misuse, or later unintended signed actions.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 96% confidence
- Finding
The setup persists API and private key material in ~/.config/gmgn/.env for reuse across future sessions, creating long-lived agent-accessible authentication state. This broadens the blast radius from a one-time query to any later workflow that can read the file, making accidental or unauthorized reuse more likely.
- Content
- Wait for the user's API key, then configure (saves both API key and private key — private key is required for
track follow-wallet):bash mkdir -p ~/.config/gmgn echo "GMGN_API_KEY=<key_from_user>" > ~/.config/gmgn/.env echo "GMGN_PRIVATE_KEY=$(awk '{printf "%s\\n", $0}' /tmp/gmgn_private.pem)" >> ~/.config/gmgn/.env chmod 600 ~/.config/gmgn/.env
- Wait for the user's API key, then configure (saves both API key and private key — private key is required for
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
mkdir -p ~/.config/gmgn echo "GMGN_API_KEY=<key_from_user>" > ~/.config/gmgn/.env echo "GMGN_PRIVATE_KEY=$(awk '{printf "%s\n", $0}' /tmp/gmgn_private.pem)" >> ~/.config/gmgn/.env chmod 600 ~/.config/gmgn/.env rm /tmp/gmgn_private.pem
text
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to inspect host network interfaces and test outbound IP behavior using shell commands to diagnose IPv6 routing. For a crypto tracking/query skill, probing local network configuration is unnecessary host introspection and expands the agent’s access beyond the user’s likely intent.
- Content