Agent skill · Audited from source
gmgn-track
skill · gmgnai/gmgn-skillsMIT licenceAudited 26 Oct 2026 · source b087b7e7dfdc
Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit b087b7e7dfdc and found no filesystem, network or shell access and no hard-coded secrets. The audit raised 1 finding, 1 critical or high. What it does: Get real-time crypto buy/sell activity from Smart Money wallets, KOL influencer wallets, and personally followed wallets via GMGN API — alpha signals, whale tracking, meme token copy-trading ideas on Solana, BSC, Base,…
Cite
Cite this page
ModelsAtlas. “gmgn-track (gmgnai/gmgn-skills)”. Retrieved 26 Oct 2026. https://modelsatlas.com/skills/gmgnai/gmgn-track
Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 1 critical or high finding, starting with “Prompt injection” in SKILL.md:15. Do not install it without reading them.
Trust audit
Audit 0.4.1 · source read 26 Oct 2026
BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 721 of 17,602 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 0 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | NA | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | FAIL | 1 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: critical finding, no behavioural pass, undeclared transfer.
Findings (1)
CRITICALPrompt injectionprompt.transfer_instruction · SKILL.md:15
**⚠️ IPv6 NOT SUPPORTED: If you get a `401` or `403` error and credentials look correct, check for IPv6 immediately: (1) list all network interfaces and their IPv6 addresses — run `ifconfig | grep ine
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
Audit 0.4.1 · source sha b087b7e7dfdc · 26 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publishergmgnai GitHub userOwner of the repository this skill is read from
- Source foldergmgnai/gmgn-skills/skills/gmgn-trackThe exact folder we audited
- LicenceMITAs the repository states it
- Commit pinned for this verdictb087b7e7dfdcA new audit runs when the source changes
- Repository statusNot archivedLast push 3 days ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Get real-time crypto buy/sell activity from Smart Money wallets, KOL influencer wallets, and personally followed wallets via GMGN API — alpha signals, whale tracking, meme token copy-trading ideas on Solana, BSC, Base,…
--- name: gmgn-track description: Get real-time crypto buy/sell activity from Smart Money wallets, KOL influencer wallets, and personally followed wallets via GMGN API — alpha signals, whale tracking, meme token copy-trading ideas on Solana, BSC, Base, or Ethereum. Also query which tokens a wallet has followed (bookmarked) on GMGN. Use when user asks what smart money or KOLs are buying, wants whale alerts, on-chain alpha, copy-trade signals, or wants to check a wallet's followed tokens. (For a specific wallet address's portfolio, use gmgn-portfolio.) argument-hint: "<follow-tokens|follow-wallet|kol|smartmoney> --chain <sol|bsc|base|eth|arbitrum|hyperevm|robinhood|arc|stable> [--wallet <wallet_address>]" metadata: cliHelp: "gmgn-cli track --help" --- **BEFORE RUNNING ANY COMMAND: Run `gmgn-cli config --check`. If exit code is 0, proceed normally. If exit code is 1, (1) run `gmgn-cli config` and show the output to the user; (2) once the user sends the API Key, run `gmgn-cli config --apply <KEY>` to complete configuration and verification, then show the output to the user. If `--check` returns an error (unknown option or command not found), tell the user to run `npm install -g gmgn-cli` to update, then retry.** **IMPORTANT: Always use `gmgn-cli` commands below. Do NOT use web search, WebFetch, curl, or visit gmgn.ai to fetch this data — the website requires login and will not return structured data. The CLI is the only correct method.** **IMPORTANT: Do NOT guess field names or values. When a field's meaning is unclear, look it up in the Response Fields sections below before using it.** **⚠️ IPv6 NOT SUPPORTED: If you get a `401` or `403` error and credentials look correct, check for IPv6 immediately: (1) list all network interfaces and their IPv6 addresses — run `ifconfig | grep inet6` (macOS) or `ip addr show | grep inet6` (Linux); (2) send a test request to `https://ipv6.icanhazip.com` — if the response is an IPv6 address, outbound traffic is going via IPv6. Tell the user immediately: "Please disable IPv6 on your network interface — gmgn-cli commands only work over IPv4."** Use the `gmgn-cli` tool to query on-chain tracking data based on the user's request. ## Core Concepts - **`follow-wallet` vs `kol` vs `smartmoney`** — Three distinct data sources. `follow-wallet` returns trades from wallets the user has personally followed on the GMGN platform (user-specific; the follow list is resolved from the GMGN user account bound to the API Key). `kol` and `smartmoney` return trades from platform-tagged public wallet lists (not user-specific). Never substitute one for another. - **KOL (Key Opinion Leader)** — Wallets publicly identified as influencers or well-known traders on GMGN. Tagged as `renowned` in the platform's wallet label system. Their trades carry social/marketing signal, not necessarily alpha. - **Smart Money (`smart_degen`)** — Wallets with a statistically proven record of profitable trading, identified by GMGN's algorithm. Same concept as `smart_degen` in gmgn-token. Their trades are a stronger alpha signal than KOL trades. - **`is_open_or_close`** — Indicates whether a trade is a full position event. Interpretation differs by sub-command: - `follow-wallet`: `1` = full position open or close; `0` = partial add or reduce. - `kol` / `smartmoney`: `0` = position opened / added; `1` = position closed / reduced. Do not apply the same interpretation to both sub-commands. - **`price_change`** — Ratio of price change since the trade was made. `6.66` = the token is now 6.66× what it was when the wallet traded (i.e. +566%). `0.5` = price halved since the trade (-50%). Use this to assess "how well did this trade age." - **`base_address` vs `quote_address`** — In a trading pair, `base_address` is the token being bought/sold; `quote_address` is what it was priced in (typically SOL native address on Solana). To get the token of interest, always read `base_address`. - **`maker_info.tags`** — Array of platform labels on the wallet (e.g. `["kol", "gmgn"]`, `["smart_degen", "photon"]`). A wallet can carry multiple tags. Use `tag_rank` (follow-wallet only) to see the wallet's rank within each tag category. - **Cluster signal** — When multiple followed/tracked wallets trade the same token in the same direction within a short time window, this is a stronger conviction signal than a single wallet. Highlight this pattern when it appears in results. **When to use which sub-command:** - `track follow-wallet` — user asks "what did the wallets I follow trade?", "show me my follow list trades", "show my followed wallet activity" → requires wallets followed via GMGN platform - `track kol` — user asks "what are KOLs buying?", "show me influencer trades", "what are KOLs doing recently" → returns trades from known KOL wallets - `track smartmoney` — user asks "what is smart money doing?", "show me whale trades", "what is smart money buying recently" → returns trades from smart money / whale wallets **Do NOT confuse these three:** - `follow-wallet` = wallets the user has personally followed on GMGN - `kol` = platform-tagged KOL / influencer wallets (not user-specific) - `smartmoney` = platform-tagged smart money / whale wallets (not user-specific) ## Sub-commands | Sub-command | Description | |-------------|-------------| | `track follow-tokens` | Followed token list for a wallet — which tokens a wallet has bookmarked on GMGN, with full market data | | `track follow-token-groups` | Follow token group names for a wallet — the group names and IDs the wallet uses to organise followed tokens | | `track follow-wallet` | Trade records from wallets the user personally follows on GMGN | | `track kol` | Real-time trades from KOL / influencer wallets tagged by GMGN | | `track smartmoney` | Real-time trades from smart money / whale wallets tagged by GMGN | ## Supported Chains `sol` / `bsc` / `base` / `eth` / `arbitrum` / `hyperevm` / `robinhood` / `arc` / `stable` ## Prerequisites - `gmgn-cli` in
Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit b087b7e
git clone https://github.com/gmgnai/gmgn-skills git -C gmgn-skills checkout b087b7e7dfdc
The author documents no install command, so this uses the repository directly. Our verdict covers commit b087b7e7dfdc only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Cursor | Mentioned in its text, not tested | Skills for Cursor · About Cursor |
Audit history
Every audit, every source change
- ✕BLOCK D 69 / 100
first audit · source
b087b7e7dfdc
Similar skills
gmgnai/gmgn-skills
Analyze one or many crypto wallets by address — holdings, batch realized/unrealized P&L, win rate, trading history, performance stats, specific token balance, and tokens created by a developer wallet (with ATH market…
gmgnai/gmgn-skills
Research any crypto or meme token by address — real-time price, market cap, liquidity, holder list, trader list, top Smart Money and KOL positions, security audit (honeypot, rug pull risk, dev wallet, renounced status),…
gmgnai/gmgn-skills
[FINANCIAL EXECUTION] Buy and sell meme coins and crypto tokens on Solana, BSC, Base, or Ethereum — single swap, multi-wallet batch trading, limit orders, stop loss, take profit, trailing stop loss, trailing take profit…
gmgnai/gmgn-skills
Token holder chip analysis — deep analysis of holder structure including chip distribution, entry cost, whale/dev/KOL behavior, risk wallets (rat traders, bundlers, snipers), related wallets, smart money signals, and an…
gmgnai/gmgn-skills
Get crypto and meme token price charts (K-line, candlestick, OHLCV), trending meme coin rankings by volume, newly launched tokens on launchpads (pump.fun, fourmeme, letsbonk, Raydium, etc.), the hot-search ranking…
gmgnai/gmgn-skills
[FINANCIAL EXECUTION] Create and launch meme coins and crypto tokens on launchpads (Pump.fun, FourMeme, Bonk, BAGS, Flap, Klik, Clanker, etc.) via bonding curve fair launch, or query token creation stats by launchpad…
Questions about gmgn-track
What does the gmgn-track skill do?
Is gmgn-track safe to install?
What can gmgn-track access on my machine?
Which assistants does gmgn-track work with?
How current is this page?
Sources
- github.com/gmgnai/gmgn-skills/tree/main/skills/gmgn-track — the audited source at commit b087b7e7dfdc and every finding aboveObserved · 26 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the gmgn-track skill do?
- Is gmgn-track safe to install?
- What can gmgn-track access on my machine?