此报告尚无所请求语言的翻译，当前显示规范英文报告。
版本化安全评估
报告编号: SA-E5464E66
9/5/2026, 11:33:12 AM
gmgn-swap 安全评估 v1
Skill 安全认证报告
扫描器版本 3.0.0 审计模型: codex 最新发布的报告
- 技能名称
- gmgn-swap
- 版本
- v1
- 维护者
- gmgnai
- 覆盖范围
- 1 已扫描文件 · 849 分析行数
- 策略版本
- skillstore-security-audit-policy-v1
已确认问题的最高严重性
严重
有 13 个已确认的安全问题需要处理。
安装上下文
请查看当前 Skill 详情页
本页仅汇总报告证据。Skill 详情页提供 canonical install advisory。
打开当前 Skill 详情页本报告不会阻止或授权 manifest 或 ZIP。
The skill intentionally executes irreversible trades through an external CLI and relies on API and wallet private keys stored in a hidden environment file. Most backtick findings are Markdown false positives, but credential solicitation, secret access, financial commands, network reconnaissance, and confirmation bypasses are confirmed. Publication should wait until credential collection and transaction approval controls are redesigned. Static review was capped at 400/430 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
报告位置
最新发布的报告
“最新”仅指报告序列，不代表 artifact 当前有效。
审计证明
有效证明
此精确报告有可公开验证的证明。
人工验证
未进行人工验证
本报告没有人工验证记录。
覆盖范围
1 已扫描文件 · 849 分析行数
有 47 项内容需要查看
局限
本报告不声称进行了运行时或沙箱执行，也不证明不存在副作用。
证据链
证据从来源绑定延伸到安装契约。证据可用于验证，但不是安全保证。
来源
已绑定 commit 与路径
构件
已绑定内容与 tree hash
审计
已完成
观察到的能力
“已观察到”表示本报告记录了支持证据；“未记录”不证明该能力不存在。
包含脚本
可能执行 Skill 随附的代码。
本次审计未记录
网络访问
可能连接外部服务。
在 7 个证据位置观察到
文件系统访问
可能读取或写入本地文件。
在 4 个证据位置观察到
环境变量
可能读取进程环境中的值。
在 11 个证据位置观察到
外部命令
可能调用 Skill 之外的命令或程序。
在 63 个证据位置观察到
能力复核项 (34)
严重
Ruby/shell backtick execution
**BEFORE RUNNING ANY COMMAND: Run `gmgn-cli config --check`. If exit code is 0, proceed normally. If
This instruction runs external configuration commands and places a user-supplied API key in a command argument. That can expose a trade-authorized credential through chat, process listings, or shell history.
高
Generic API/secret keys
Use the `gmgn-cli` tool to submit a token swap or query an existing order. `GMGN_API_KEY` is always
The line documents active use of GMGN credentials for authenticated CLI operations. These credentials can execute trades on linked wallets and therefore represent sensitive environment access.
高
Generic API/secret keys
- **Signed auth** — `swap` and most `order` subcommands require both `GMGN_API_KEY` and `GMGN_PRIVAT
The line documents active use of GMGN credentials for authenticated CLI operations. These credentials can execute trades on linked wallets and therefore represent sensitive environment access.
高
Generic API/secret keys
`GMGN_API_KEY` must be configured in `~/.config/gmgn/.env`. `GMGN_PRIVATE_KEY` is additionally requi
The line documents active use of GMGN credentials for authenticated CLI operations. These credentials can execute trades on linked wallets and therefore represent sensitive environment access.
高
Generic API/secret keys
Before displaying the confirmation, run `order quote` to get the estimated output (requires signed a
The line documents active use of GMGN credentials for authenticated CLI operations. These credentials can execute trades on linked wallets and therefore represent sensitive environment access.
高
Generic API/secret keys
Submit a token swap across multiple wallets concurrently. Each wallet executes independently — one w
The line documents active use of GMGN credentials for authenticated CLI operations. These credentials can execute trades on linked wallets and therefore represent sensitive environment access.
高
Generic API/secret keys
- Both `GMGN_API_KEY` and `GMGN_PRIVATE_KEY` are read from the `.env` file by the CLI at startup. Th
The line documents active use of GMGN credentials for authenticated CLI operations. These credentials can execute trades on linked wallets and therefore represent sensitive environment access.
高
Generic API/secret keys
- `GMGN_PRIVATE_KEY` is used exclusively for **local message signing** — the private key never leave
The line documents active use of GMGN credentials for authenticated CLI operations. These credentials can execute trades on linked wallets and therefore represent sensitive environment access.
高
Generic API/secret keys
- `GMGN_API_KEY` is transmitted in the `X-APIKEY` request header to GMGN's servers over HTTPS.
The line documents active use of GMGN credentials for authenticated CLI operations. These credentials can execute trades on linked wallets and therefore represent sensitive environment access.
高
Generic API/secret keys
Get an estimated output amount before submitting a swap. Uses normal auth — only `GMGN_API_KEY` requ
The line documents active use of GMGN credentials for authenticated CLI operations. These credentials can execute trades on linked wallets and therefore represent sensitive environment access.
高
Generic API/secret keys
- `order strategy create`, `order strategy list`, and `order strategy cancel` use signed auth (requi
The line documents active use of GMGN credentials for authenticated CLI operations. These credentials can execute trades on linked wallets and therefore represent sensitive environment access.
高
Generic API/secret keys
- **Credential sensitivity** — `GMGN_API_KEY` and `GMGN_PRIVATE_KEY` can directly execute trades on
The line documents active use of GMGN credentials for authenticated CLI operations. These credentials can execute trades on linked wallets and therefore represent sensitive environment access.
高
Hidden file in home directory
`GMGN_API_KEY` must be configured in `~/.config/gmgn/.env`. `GMGN_PRIVATE_KEY` is additionally requi
The skill requires reading API and private keys from a hidden file under the user home directory. Access to that plaintext credential file is security-sensitive.
高
Ruby/shell backtick execution
Use the `gmgn-cli` tool to submit a token swap or query an existing order. `GMGN_API_KEY` is always
The line directs use of gmgn-cli to submit token swaps and query orders. The external command can initiate irreversible financial transactions.
高
Ruby/shell backtick execution
- Every `swap` and `order strategy create` command submits an on-chain transaction that moves real f
The text confirms that the named external commands submit on-chain transactions moving real funds. This is an intentional, high-impact command capability.
高
Ruby/shell backtick execution
```bash
This fenced shell block contains gmgn-cli swap commands that submit irreversible token trades. The external command examples are intended for execution by the agent.
高
Ruby/shell backtick execution
```bash
This fenced shell example invokes gmgn-cli swap with conditional sell orders. Execution can move funds and create follow-on financial actions.
高
Ruby/shell backtick execution
```bash
This fenced shell example invokes gmgn-cli swap with fixed-amount strategy conditions. Execution can move funds and create follow-on orders.
高
Ruby/shell backtick execution
Submit a token swap across multiple wallets concurrently. Each wallet executes independently — one w
The section directs concurrent swaps across as many as 100 wallets. This external operation can move funds from multiple accounts in one request.
高
Ruby/shell backtick execution
```bash
This fenced shell block contains multi-swap commands that can execute token trades across multiple wallets. The examples are intended operational commands.
高
Ruby/shell backtick execution
```bash
This fenced shell block creates take-profit, stop-loss, and smart-trade orders. These commands authorize future financial transactions using the linked wallet.
高
Ruby/shell backtick execution
```bash
This fenced shell block invokes strategy cancellation. Canceling an active protective or limit order changes the wallet owner's financial exposure.
中
Hidden file access
`GMGN_API_KEY` must be configured in `~/.config/gmgn/.env`. `GMGN_PRIVATE_KEY` is additionally requi
The skill requires reading API and private keys from a hidden file under the user home directory. Access to that plaintext credential file is security-sensitive.
中
Ruby/shell backtick execution
**IMPORTANT: Always use `gmgn-cli` commands below. Do NOT use web search, WebFetch, curl, or visit g
The line explicitly directs the agent to use the external gmgn-cli program for all swap operations. The command execution is intentional and central to the skill.
中
Ruby/shell backtick execution
**⚠️ IPv6 NOT SUPPORTED: If you get a `401` or `403` error and credentials look correct, check for I
The instruction executes local network-enumeration commands and sends a request to an external IP service. This is real external command execution, although its stated purpose is IPv6 troubleshooting.
中
Ruby/shell backtick execution
- **`order_id` / `status`** — After submitting a swap, the response includes an `order_id`. Use `ord
The line instructs the agent to invoke order get for status polling. This is a real authenticated external command, although it is read-only.
中
Ruby/shell backtick execution
- `gmgn-cli` installed globally — if missing, run: `npm install -g gmgn-cli`
The line instructs a global npm installation of gmgn-cli. This is real external command execution with package supply-chain and system-wide installation risk.
中
Ruby/shell backtick execution
Before displaying the confirmation, run `order quote` to get the estimated output (requires signed a
The line explicitly instructs the agent to run order quote before confirmation. This is a real authenticated external command, but the operation is described as read-only.
中
Ruby/shell backtick execution
```bash
This fenced shell block invokes gmgn-cli order quote. The external command performs an authenticated network request without submitting a transaction.
中
Ruby/shell backtick execution
```bash
This fenced shell block invokes the authenticated order quote command. It is real external command execution, though it does not submit a trade.
中
Ruby/shell backtick execution
```bash
This fenced shell block invokes the authenticated order get command. It queries order state and does not itself submit a transaction.
中
Ruby/shell backtick execution
```bash
This fenced shell block invokes gmgn-cli gas-price against remote services. The commands are read-only but require external process and network access.
中
Ruby/shell backtick execution
```bash
This fenced shell block invokes authenticated strategy-list commands. The operation is read-only but still executes an external CLI with wallet credentials.
低
Hardcoded URL
**⚠️ IPv6 NOT SUPPORTED: If you get a `401` or `403` error and credentials look correct, check for I
The troubleshooting flow sends a request to a fixed third-party IP service, revealing the user's public address. The endpoint is purposeful but creates an external network and privacy dependency.
风险问题
已确认的安全问题与仍需审核的项目分开展示。
已确认安全问题 (13)
RISK-001 严重
Trade-Authorized API Key Solicited in Chat and Command Arguments
The setup flow says the user should send the API key, then directs `gmgn-cli config --apply <KEY>`. This exposes a trade-authorized secret to conversation logs and process arguments.
Line 31 directly requests the API key from the user and embeds it in a command argument; lines 448 and 839 explicitly prohibit that handling.
RISK-002 高
Crypto seed/private key mention
is the only skill holding a private key, and every buy still ends here. It
The text states that this workflow holds or uses a wallet private key for authenticated trading. Compromise or misuse of that key can authorize irreversible financial actions.
RISK-003 高
Crypto seed/private key mention
- **Signed auth** — `swap` and most `order` subcommands require both `GMGN_API_KEY` and `GMGN_PRIVAT
The text states that this workflow holds or uses a wallet private key for authenticated trading. Compromise or misuse of that key can authorize irreversible financial actions.
RISK-004 高
Crypto seed/private key mention
| `order strategy create` | Create a limit/strategy order (requires private key) |
The text states that this workflow holds or uses a wallet private key for authenticated trading. Compromise or misuse of that key can authorize irreversible financial actions.
RISK-005 高
Crypto seed/private key mention
| `order strategy list` | List strategy orders (requires private key) |
The text states that this workflow holds or uses a wallet private key for authenticated trading. Compromise or misuse of that key can authorize irreversible financial actions.
RISK-006 高
Crypto seed/private key mention
| `order strategy cancel` | Cancel a strategy order (requires private key) |
The text states that this workflow holds or uses a wallet private key for authenticated trading. Compromise or misuse of that key can authorize irreversible financial actions.
RISK-007 高
Crypto seed/private key mention
`GMGN_API_KEY` must be configured in `~/.config/gmgn/.env`. `GMGN_PRIVATE_KEY` is additionally requi
The text states that this workflow holds or uses a wallet private key for authenticated trading. Compromise or misuse of that key can authorize irreversible financial actions.
RISK-008 高
Crypto seed/private key mention
- `GMGN_PRIVATE_KEY` is used exclusively for **local message signing** — the private key never leave
The text states that this workflow holds or uses a wallet private key for authenticated trading. Compromise or misuse of that key can authorize irreversible financial actions.
RISK-009 高
Environment file access
`GMGN_API_KEY` must be configured in `~/.config/gmgn/.env`. `GMGN_PRIVATE_KEY` is additionally requi
The CLI is instructed to read GMGN API and private keys from a hidden .env file. Plaintext credential storage and automated access create a direct secret-exposure risk.
RISK-010 高
Environment file access
- Both `GMGN_API_KEY` and `GMGN_PRIVATE_KEY` are read from the `.env` file by the CLI at startup. Th
The CLI is instructed to read GMGN API and private keys from a hidden .env file. Plaintext credential storage and automated access create a direct secret-exposure risk.
RISK-011 高
Token Safety Checks Can Be Bypassed for Irreversible Purchases
The skill permits users to skip its limited token check and proceed with a contract address. This can enable copycat, honeypot, or rug-token purchases without independent verification.
The documented entry flow and explicit override both allow execution without the required pre-swap check, while the skill acknowledges its check is incomplete.
RISK-012 高
Persistent Automation Flag Removes Per-Trade Human Confirmation
A preconfigured environment flag combined with `--yes` bypasses the terminal confirmation. An agent can then submit irreversible trades without fresh human approval for each transaction.
The documentation explicitly defines a headless path that suppresses confirmation whenever the persistent environment flag and command option are present.
RISK-013 低
Network reconnaissance
**⚠️ IPv6 NOT SUPPORTED: If you get a `401` or `403` error and credentials look correct, check for I
The line instructs enumeration of local IPv6 interfaces and an external IP check. This is limited network reconnaissance for troubleshooting, but it still discloses network configuration.
补救措施
本次审计记录了建议的修复措施。实施这些措施是维护者的责任。
- FIX-001严重The setup flow asks users to send an API key and places it in a command argument.Move credential setup outside the agent session and accept secrets through protected interactive input or an operating-system credential store.
- FIX-002高Wallet private keys are stored in a plaintext hidden environment file.Use hardware-backed signing or an operating-system keychain, restrict file permissions, and document key rotation and revocation procedures.
- FIX-003高Users can bypass a limited token safety check before an irreversible purchase.Require contract verification and comprehensive token checks for every purchase. Do not allow phrase-based bypasses for unverified contracts.
- FIX-004高A persistent automation flag removes per-transaction terminal confirmation.Require a fresh, transaction-bound approval containing chain, wallet, tokens, amount, slippage, fees, and expiration for every financial action.
- FIX-005中Static review cappedManually review the omitted 30 static analyzer matches or reduce bundled generated/vendor/reference content before enabling automatic publication.
- FIX-006中Installation uses an unpinned global npm package.Pin an audited gmgn-cli version and integrity hash, then verify the installed binary before any credential or trading operation.
- FIX-007低IPv6 troubleshooting enumerates interfaces and contacts a third-party IP service.Request user consent before diagnostics and prefer local checks that do not disclose the public address to another service.
专家证据
不可变主体身份、扫描器元数据、已排除匹配项和源码级证据。
Artifact 主体
- Marketplace 提交
- e5464e662405de6361fdde6b984f9ea865635f64
- 内容哈希
- 009bd587e76a9f56c5b6b6a5b1bdda5b6ee60ccd9179497c377c821ac86a4b67
- 目录树哈希
- 2fca6503eb4331888ea5fe3b4b0d849609c585ccdd8b94336f0f9be13861c3f1
- Skill 路径
- skills/gmgnai/gmgn-swap
- 审计载荷哈希
- 81769ad77ef04cba15e0f7173f3eeff7
分析元数据
审计模型: codex
分析状态: 已完成
范围仅限于已记录的文件、行数、方法和证据；本报告不声称进行了运行时或沙箱执行。
验证与导出
manifest 和 lockfile 将安装 artifact 绑定到加密哈希。该完整性声明独立于安全评估。
审计证明: active