Security audit

Gmgn Base Tracker

Security checks for vulnerabilities and agentic risk

Overview

This is a single Markdown crypto-tracking skill that performs disclosed public web lookups and does not install code, persist, or modify user data.

Install only if you want real-time public crypto market and wallet analytics for Base-chain tokens. Use explicit prompts such as 'gmgn trending base' or 'wallet 0x...' to avoid accidental activation, and treat all token and wallet signals as speculative public-market information, not financial advice.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

Confidence: 90% confidence
Finding: Trigger phrases like 'trending', '1h', 'kol', 'live', 'monitor', 'smart money', and 'new tokens' are common in normal crypto discussion and can collide with benign user messages. Overbroad matching may cause the skill to activate unexpectedly, perform external lookups, and steer the conversation into speculative trading outputs the user did not request.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The manifest and top-level description frame the skill as a token tracker, but later sections add wallet profiling, wallet classification, PnL, win rate, and recent-trade lookup. This capability expansion can surprise users and downstream systems, causing the skill to process more sensitive behavioral data than its declared scope suggests.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: Using a generic trigger like 'help' can activate the skill during unrelated conversations, causing unintended web searches and crypto-analysis behavior. In an agent environment, broad activation increases the chance of context hijacking, user confusion, or accidental processing of wallet/token data without clear intent.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill includes wallet profiling with labels like Smart Money, KOL, Fresh, or Regular plus performance metrics and recent trades, but the description does not warn users that wallet activity will be analyzed and summarized. This weakens informed consent and increases privacy and surveillance concerns, even when using public blockchain data.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The skill produces highly speculative token-trading and launch-monitoring output, including signals such as sniper activity, smart money inflows, and near-bonding tokens, but lacks a clear risk warning. This can encourage users to over-trust volatile trading signals and increases the chance of financial harm from misunderstood or impulsive decisions.