gavindiaz/gmgn-skills
1
0
Fork 0
mirror of https://github.com/GMGNAI/gmgn-skills.git synced 2026-07-27 16:57:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): defend against prompt injection via token metadata

Browse Source 
Address HackenProof report GMGNWM-143, where attacker-controlled token metadata
could hijack an AI agent driving gmgn-cli into executing an unauthorized trade.
Move guardrails from overridable SKILL.md text into code.

- Add src/sanitize.ts: neutralize prompt-injection framing and hidden/control
  characters in API output (via printResult) and validate create-token metadata
- Add src/confirm.ts: code-enforced human confirmation for financial writes
  (swap, multi-swap, order strategy create, cooking create) — reads a typed
  "yes" from /dev/tty; automation requires GMGN_ALLOW_AUTOMATED_TRADES=1 + --yes
- Harden config.ts: tighten ~/.config/gmgn/.env to 0600 and warn if world-readable
- Update SKILL.md files, Readme.md and Readme.zh.md to document the gate,
  the --yes flag, and untrusted-metadata handling

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
David Lau
2026-07-08 11:39:21 +08:00
parent b18d7deb32
commit fdc7a3fb16
11 changed files with 267 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Readme.md
+2
View File
@@ -540,6 +540,8 @@ gmgn-cli track smartmoney --chain sol --side sell --limit 50 --raw
### Swap / Quote / Query
> **Human confirmation is enforced in code.** `swap`, `multi-swap`, `order strategy create`, and `cooking create` prompt for a typed `yes` on the terminal before executing. For non-interactive/automated use you must both set `GMGN_ALLOW_AUTOMATED_TRADES=1` in your shell and pass `--yes`; `--yes` alone is rejected. This guards against an AI agent being tricked (e.g. by malicious token metadata) into placing a trade without you.
```bash
# Submit swap with fixed slippage
gmgn-cli swap \