From 18a0bf98b18053b40082ec64a3c6b8001a97af1f Mon Sep 17 00:00:00 2001 From: gina888666 Date: Tue, 30 Jun 2026 17:18:31 +0800 Subject: [PATCH] docs(skills): restore Credential Model section to all 6 SKILL.md files Co-Authored-By: Claude Sonnet 4.6 --- skills/gmgn-cooking/SKILL.md | 6 ++++++ skills/gmgn-market/SKILL.md | 6 ++++++ skills/gmgn-portfolio/SKILL.md | 6 ++++++ skills/gmgn-swap/SKILL.md | 6 ++++++ skills/gmgn-token/SKILL.md | 6 ++++++ skills/gmgn-track/SKILL.md | 6 ++++++ 6 files changed, 36 insertions(+) diff --git a/skills/gmgn-cooking/SKILL.md b/skills/gmgn-cooking/SKILL.md index df238f8..bb2589a 100644 --- a/skills/gmgn-cooking/SKILL.md +++ b/skills/gmgn-cooking/SKILL.md @@ -658,6 +658,12 @@ Once all information is collected, present the pre-create confirmation summary ( - **Order polling** — After `cooking create`, if `status` is `pending`, poll `order get` every 2 seconds up to 30 seconds. The token address is in `report.output_token`. Do not report success until `status` is `confirmed`. - **Credential sensitivity** — `GMGN_API_KEY` and `GMGN_PRIVATE_KEY` can execute real transactions. Never log, display, or expose these values. +### Credential Model + +- `GMGN_PRIVATE_KEY` is used exclusively for **local message signing** — the private key never leaves the machine. The CLI computes an Ed25519 signature in-process and transmits only the base64-encoded result in the `X-Signature` request header. +- `GMGN_API_KEY` is transmitted in the `X-APIKEY` header over HTTPS. +- Neither credential is ever passed as a command-line argument. + ## Notes - `cooking create` uses **signed auth** (API Key + signature) — CLI handles signing automatically. diff --git a/skills/gmgn-market/SKILL.md b/skills/gmgn-market/SKILL.md index ea62a6a..5ebf970 100644 --- a/skills/gmgn-market/SKILL.md +++ b/skills/gmgn-market/SKILL.md @@ -1031,6 +1031,12 @@ gmgn-cli market signal --chain sol \ --- +### Credential Model + +- `GMGN_PRIVATE_KEY` is used exclusively for **local message signing** — the private key never leaves the machine. The CLI computes an Ed25519 signature in-process and transmits only the base64-encoded result in the `X-Signature` request header. +- `GMGN_API_KEY` is transmitted in the `X-APIKEY` header over HTTPS. +- Neither credential is ever passed as a command-line argument. + ## Notes - `market kline`: `--from` and `--to` are Unix timestamps in **seconds** — CLI converts to milliseconds automatically diff --git a/skills/gmgn-portfolio/SKILL.md b/skills/gmgn-portfolio/SKILL.md index 8e34488..c0e117b 100644 --- a/skills/gmgn-portfolio/SKILL.md +++ b/skills/gmgn-portfolio/SKILL.md @@ -352,6 +352,12 @@ PnL Ratio: {pnl}x Show the `[Identity: ...]` line only if `common` is present in the response. For batch queries (multiple wallets), present one summary block per wallet. +### Credential Model + +- `GMGN_PRIVATE_KEY` is used exclusively for **local message signing** — the private key never leaves the machine. The CLI computes an Ed25519 signature in-process and transmits only the base64-encoded result in the `X-Signature` request header. +- `GMGN_API_KEY` is transmitted in the `X-APIKEY` header over HTTPS. +- Neither credential is ever passed as a command-line argument. + ## Notes - `portfolio holdings` uses **critical auth** (`GMGN_API_KEY` + `GMGN_PRIVATE_KEY` required — CLI signs the request automatically). All other portfolio commands use exist auth (API Key only, no signature required). diff --git a/skills/gmgn-swap/SKILL.md b/skills/gmgn-swap/SKILL.md index dcaf620..67ffe79 100644 --- a/skills/gmgn-swap/SKILL.md +++ b/skills/gmgn-swap/SKILL.md @@ -734,6 +734,12 @@ gmgn-cli order strategy cancel \ --- +### Credential Model + +- `GMGN_PRIVATE_KEY` is used exclusively for **local message signing** — the private key never leaves the machine. The CLI computes an Ed25519 signature in-process and transmits only the base64-encoded result in the `X-Signature` request header. +- `GMGN_API_KEY` is transmitted in the `X-APIKEY` header over HTTPS. +- Neither credential is ever passed as a command-line argument. + ## Notes - Swap uses **signed auth** (API Key + signature) — CLI handles signing automatically, no manual processing needed diff --git a/skills/gmgn-token/SKILL.md b/skills/gmgn-token/SKILL.md index 081f7bc..b52cc8b 100644 --- a/skills/gmgn-token/SKILL.md +++ b/skills/gmgn-token/SKILL.md @@ -707,6 +707,12 @@ SM holders: {smart_wallets} KOL holders: {renowned_wallets} Show top rows only. Highlight wallets tagged `kol`, `smart_degen`, or flagged `bundler` / `rat_trader` in `maker_token_tags`. +### Credential Model + +- `GMGN_PRIVATE_KEY` is used exclusively for **local message signing** — the private key never leaves the machine. The CLI computes an Ed25519 signature in-process and transmits only the base64-encoded result in the `X-Signature` request header. +- `GMGN_API_KEY` is transmitted in the `X-APIKEY` header over HTTPS. +- Neither credential is ever passed as a command-line argument. + ## Notes - **Market cap is not returned directly** — calculate it as `price.price × circulating_supply` (`price` is now a nested object; use `price.price` for the current USD price string, and `circulating_supply` is a top-level field already in human-readable token units). Example: `price.price="3.11"` × `circulating_supply=999999151` ≈ $3.11B market cap. diff --git a/skills/gmgn-track/SKILL.md b/skills/gmgn-track/SKILL.md index f1d9605..a1f3762 100644 --- a/skills/gmgn-track/SKILL.md +++ b/skills/gmgn-track/SKILL.md @@ -369,6 +369,12 @@ To research any token surfaced by smart money activity, follow [`docs/workflow-t - **`follow-wallet` reveals your following list** — results expose which wallets you have followed on GMGN. Do not share raw output in public channels. - **`track kol` / `track smartmoney` expose no personal data** — these use API Key auth only and return platform-tagged public wallet activity. Safe to share raw output. +### Credential Model + +- `GMGN_PRIVATE_KEY` is used exclusively for **local message signing** — the private key never leaves the machine. The CLI computes an Ed25519 signature in-process and transmits only the base64-encoded result in the `X-Signature` request header. +- `GMGN_API_KEY` is transmitted in the `X-APIKEY` header over HTTPS. +- Neither credential is ever passed as a command-line argument. + ## Notes - `track follow-tokens` uses exist auth (API Key only); `--wallet` is required