GMGN Skill Track

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:29 AM UTC
• Version: 1.4.6

Overview

The skill is meant to query GMGN crypto tracking data, but its setup handles API and signing keys in unsafe, persistent ways and installs a mutable global CLI package.

Review before installing. Prefer installing a verified, pinned gmgn-cli yourself, configure secrets outside the agent or through a secret manager, and only create a GMGN private signing key if you explicitly need follow-wallet. Treat outputs as informational crypto data, not trading advice.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:64
• Finding: Unpinned Global npm Package Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:64` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```markdown - `gmgn-cli` installed globally — if missing, run: `npm install -g gmgn-cli` ``` ### Technical Analysis The Skill instructs the Agent to globally install the latest available version of `gmgn-cli` without an exact version pin, integrity verification, lockfile, or source validation. npm packages may execute lifecycle scripts during installation. Because the reviewed project does not include the source code of `gmgn-cli`, its handling of the GMGN API key, signing private key, network requests, and local files cannot be independently verified. The effective behavior of the Skill can change whenever the package publisher releases a new version. ### Attack Path 1. An attacker compromises the npm package, publisher account, or upstream release process. 2. The attacker publishes a malicious version under the expected package name. 3. The Agent follows the Skill instruction and runs `npm install -g gmgn-cli`. 4. Malicious installation scripts or runtime code execute with the privileges of the Agent's operating-system account. 5. The package accesses credentials, including `~/.config/gmgn/.env`, or performs other unauthorized local and network operations. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user running the Agent. The affected scope may include: - Theft of `GMGN_API_KEY` and `GMGN_PRIVATE_KEY`. - Access to other files readable by the Agent's user account. - Unauthorized authenticated GMGN requests. - Modification of globally installed commands or packages. - Network communication and further payload retrieval under the user's identity. No evidence establishes that the current package is malicious; the vulnerability is the mutable and unverified dependency installation process. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `gmgn-cli` to an exact, previously reviewed version rather than installing the latest release. - Document and verify the official package name, publisher, and source repository. - Verify package integrity using a trusted digest, npm integrity metadata, or a committed lockfile. - Avoid global installation where possible; use a project-local, isolated dependency environment. - Disable npm lifecycle scripts during installation when compatible with the package. - Review the CLI source code, particularly its credential loading, signing, logging, update, and network-request behavior. - Run the CLI with the minimum filesystem and network privileges required for the requested operation. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:97
• Finding: Shell Command Injection Through API-Key Interpolation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:97-101` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Code ```bash mkdir -p ~/.config/gmgn echo "GMGN_API_KEY=<key_from_user>" > ~/.config/gmgn/.env echo "GMGN_PRIVATE_KEY=$(awk '{printf "%s\\n", $0}' /tmp/gmgn_private.pem)" >> ~/.config/gmgn/.env chmod 600 ~/.config/gmgn/.env rm /tmp/gmgn_private.pem ``` ### Technical Analysis The instructions require the Agent to replace `<key_from_user>` with conversationally supplied input inside a double-quoted shell command. If the value is inserted into shell source without strict validation and escaping, shell syntax embedded in the value can alter command parsing. Potentially dangerous content includes: - Command substitutions such as `$(command)`. - Backtick command substitutions. - Double quotes that terminate the intended quoted string. - Newline characters that introduce additional shell commands or configuration entries. - Shell operators or redirections introduced after escaping the quoted context. This creates a command-injection boundary between untrusted conversational input and the local shell. Merely wrapping the placeholder in double quotes is insufficient because command substitution remains active inside double-quoted shell strings. ### Attack Path 1. An attacker or untrusted party provides a purported GMGN API key containing shell metacharacters or command-substitution syntax. 2. The Agent substitutes that value verbatim for `<key_from_user>`. 3. The resulting command is passed to a shell. 4. The shell evaluates the injected syntax while processing the `echo` command. 5. Attacker-selected commands execute with the privileges of the Agent's operating-system account. For example, a malicious value containing command substitution could cause a command to run before the resulting text is written to the configuration file. ### Impact Assessment Successful exploitation permits arbitr ...[truncated 602 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never construct executable shell source by interpolating a credential received through conversation. - Validate the API key against its documented format and reject quotes, control characters, newlines, shell metacharacters, and values outside expected length limits. - Pass the value through a non-shell argument or environment channel to a dedicated configuration program. - Prefer a small, reviewed utility that creates the configuration file using filesystem APIs rather than shell parsing. - If shell use is unavoidable, supply the credential as positional data to a fixed script and write it with `printf '%s\n'` without evaluating it as source. - Create the destination file atomically with mode `0600` before writing secrets. - Do not print credentials in terminal output, command traces, logs, or error messages. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:88
• Finding: Predictable Temporary File and Excessive Private-Key Provisioning<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:65-66, 88-101` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code ```markdown - `GMGN_API_KEY` configured in `~/.config/gmgn/.env` — required for all sub-commands - `GMGN_PRIVATE_KEY` — required for `track follow-wallet` only (signed auth); not needed for `follow-tokens`, `kol`, or `smartmoney` ``` ```bash openssl genpkey -algorithm ed25519 -out /tmp/gmgn_private.pem 2>/dev/null && \ openssl pkey -in /tmp/gmgn_private.pem -pubout 2>/dev/null ``` ```bash mkdir -p ~/.config/gmgn echo "GMGN_API_KEY=<key_from_user>" > ~/.config/gmgn/.env echo "GMGN_PRIVATE_KEY=$(awk '{printf "%s\\n", $0}' /tmp/gmgn_private.pem)" >> ~/.config/gmgn/.env chmod 600 ~/.config/gmgn/.env rm /tmp/gmgn_private.pem ``` ### Technical Analysis The setup writes private key material to the fixed path `/tmp/gmgn_private.pem`. Shared temporary directories are commonly writable by multiple local users, and predictable names are susceptible to collisions and unsafe path manipulation if file creation does not enforce exclusive, non-symlink semantics. The instructions also generate and persist a signing private key during generic first-time setup even though the Skill explicitly states that this credential is required only for `track follow-wallet`. Users who request only `follow-tokens`, `kol`, or `smartmoney` therefore receive and retain a credential with capabilities beyond the minimum necessary for those operations. Although the final `.env` file is changed to mode `0600`, that permission is applied only after both credentials are written. The instructions do not set a restrictive `umask`, do not atomically create the destination with secure permissions, and store both credentials together in plaintext. ### Attack Path A local exploitation scenario is: 1. An attacker with access to the same system anticipates or observes use of `/tmp/gmgn_private.pem`. 2. The attacker ...[truncated 1365 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Generate a signing key only when the user explicitly requests `track follow-wallet`. - Do not require or provision `GMGN_PRIVATE_KEY` for `follow-tokens`, `kol`, or `smartmoney`. - Replace the fixed temporary pathname with `mktemp` or an equivalent secure file-creation API. - Create temporary files exclusively, reject symbolic links, and use a private directory accessible only to the current user. - Set `umask 077` before creating any file containing credentials. - Atomically create the final credential file with mode `0600` rather than applying permissions after writing. - Prefer an operating-system credential store or encrypted secret manager over a plaintext `.env` file. - Store API and signing credentials separately so commands can receive only the credential they require. - Ensure cleanup occurs on success, interruption, and error; securely minimize the lifetime of temporary key material. - Document key revocation and rotation procedures in case the temporary or persistent file is exposed. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (10)

Credential Access

High

• Category: Privilege Escalation

Content

2. Wait for the user's API key, then configure (saves both API key and private key — private key is required for `track follow-wallet`):
   ```bash
   mkdir -p ~/.config/gmgn
   echo "GMGN_API_KEY=<key_from_user>" > ~/.config/gmgn/.env
   echo "GMGN_PRIVATE_KEY=$(awk '{printf "%s\\n", $0}' /tmp/gmgn_private.pem)" >> ~/.config/gmgn/.env
   chmod 600 ~/.config/gmgn/.env
   rm /tmp/gmgn_private.pem

• Confidence: 98% confidence
• Finding: This line writes the user-provided GMGN API key directly into a plaintext .env file under the agent-controlled home directory. Storing credentials in plaintext creates a durable secret that may be exposed through logs, backups, later tool access, or unrelated agent tasks.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
   mkdir -p ~/.config/gmgn
   echo "GMGN_API_KEY=<key_from_user>" > ~/.config/gmgn/.env
   echo "GMGN_PRIVATE_KEY=$(awk '{printf "%s\\n", $0}' /tmp/gmgn_private.pem)" >> ~/.config/gmgn/.env
   chmod 600 ~/.config/gmgn/.env
   rm /tmp/gmgn_private.pem
   ```

• Confidence: 99% confidence
• Finding: This line persists the generated GMGN private key into the same plaintext .env file, giving the agent workflow durable access to a signing credential. Exposure of a private key is more severe than API-key leakage because it can enable authenticated signed requests and potentially broader account compromise depending on GMGN’s trust model.

Credential Access

High

• Category: Privilege Escalation

Content

mkdir -p ~/.config/gmgn
   echo "GMGN_API_KEY=<key_from_user>" > ~/.config/gmgn/.env
   echo "GMGN_PRIVATE_KEY=$(awk '{printf "%s\\n", $0}' /tmp/gmgn_private.pem)" >> ~/.config/gmgn/.env
   chmod 600 ~/.config/gmgn/.env
   rm /tmp/gmgn_private.pem
   ```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo "GMGN_API_KEY=<key_from_user>" > ~/.config/gmgn/.env
   echo "GMGN_PRIVATE_KEY=$(awk '{printf "%s\\n", $0}' /tmp/gmgn_private.pem)" >> ~/.config/gmgn/.env
   chmod 600 ~/.config/gmgn/.env
   rm /tmp/gmgn_private.pem
   ```

## Usage Examples

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description contains broad activation cues such as 'alpha signals,' 'whale tracking,' and 'copy-trading ideas,' which can cause the skill to trigger in loosely related finance conversations. Over-broad invocation increases the chance the agent enters a workflow that fetches account-linked or sensitive trading data when the user did not clearly request that specific operation.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The skill markets 'copy-trading ideas' and smart-money mimicry without guardrails, suitability checks, or clear user confirmation. In context, this nudges the agent toward actionable financial behavior based on influencer/whale activity, which can amplify risky or manipulative trading patterns.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill includes first-time setup steps that generate an Ed25519 private key, solicit an API key from the user, and persist both secrets locally in ~/.config/gmgn/.env. That materially exceeds a read-only tracking skill’s core purpose and creates a durable credential-handling pathway inside the agent workflow, increasing the chance of secret exposure, misuse, or later unintended signed actions.

Session Persistence

Medium

• Category: Rogue Agent

Content

2. Wait for the user's API key, then configure (saves both API key and private key — private key is required for `track follow-wallet`):
   ```bash
   mkdir -p ~/.config/gmgn
   echo "GMGN_API_KEY=<key_from_user>" > ~/.config/gmgn/.env
   echo "GMGN_PRIVATE_KEY=$(awk '{printf "%s\\n", $0}' /tmp/gmgn_private.pem)" >> ~/.config/gmgn/.env
   chmod 600 ~/.config/gmgn/.env

• Confidence: 96% confidence
• Finding: The setup persists API and private key material in ~/.config/gmgn/.env for reuse across future sessions, creating long-lived agent-accessible authentication state. This broadens the blast radius from a one-time query to any later workflow that can read the file, making accidental or unauthorized reuse more likely.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

mkdir -p ~/.config/gmgn
   echo "GMGN_API_KEY=<key_from_user>" > ~/.config/gmgn/.env
   echo "GMGN_PRIVATE_KEY=$(awk '{printf "%s\\n", $0}' /tmp/gmgn_private.pem)" >> ~/.config/gmgn/.env
   chmod 600 ~/.config/gmgn/.env
   rm /tmp/gmgn_private.pem
   ```

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Context-Inappropriate Capability

Low

• Confidence: 95% confidence
• Finding: The skill instructs the agent to inspect host network interfaces and test outbound IP behavior using shell commands to diagnose IPv6 routing. For a crypto tracking/query skill, probing local network configuration is unnecessary host introspection and expands the agent’s access beyond the user’s likely intent.

Static analysis

No suspicious patterns detected.