Address HackenProof report GMGNWM-143, where attacker-controlled token metadata
could hijack an AI agent driving gmgn-cli into executing an unauthorized trade.
Move guardrails from overridable SKILL.md text into code.
- Add src/sanitize.ts: neutralize prompt-injection framing and hidden/control
characters in API output (via printResult) and validate create-token metadata
- Add src/confirm.ts: code-enforced human confirmation for financial writes
(swap, multi-swap, order strategy create, cooking create) — reads a typed
"yes" from /dev/tty; automation requires GMGN_ALLOW_AUTOMATED_TRADES=1 + --yes
- Harden config.ts: tighten ~/.config/gmgn/.env to 0600 and warn if world-readable
- Update SKILL.md files, Readme.md and Readme.zh.md to document the gate,
the --yes flag, and untrusted-metadata handling
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add robinhood as a supported chain across the CLI and skills, and stop
advertising chains that are not publicly supported yet.
robinhood:
- validate.ts: add to VALID_CHAINS and treat as EVM for address checks
- reject guards for commands that do not support it: track kol,
track smartmoney, cooking create (mirrors market signal)
- --chain help updated for supported commands (token/portfolio/swap/
market kline·trending·trenches·hot-searches/track follow-*/order get/
gas-price); OpenApiClient chain comment
- docs: all SKILL.md, Readme.md, Readme.zh.md (split-out row for
unsupported commands), cli-usage.md, plugin/marketplace descriptions
disable monad/megaeth/hyperevm/tron:
- comment monad out of VALID_CHAINS (kept for quick re-enable)
- strip these chains from all --chain help, SKILL.md, cli-usage.md
(hot-searches default now 4 chains: sol/bsc/base/eth)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Add gmgn-cli config --check: pure local check for GMGN_API_KEY, exit 0 = found, exit 1 = not found
- Update BEFORE RUNNING ANY COMMAND in all 6 SKILL.md files to use --check instead of file path detection
- Add fallback instruction for outdated gmgn-cli versions (unknown option → prompt user to npm install -g gmgn-cli)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- gmgn-cli config: add multi-language guidance (zh-CN/zh-TW/en) based on system locale
- gmgn-cli config --apply <key>: write GMGN_API_KEY + GMGN_PRIVATE_KEY to ~/.config/gmgn/.env and verify via track follow-wallet
- Delete skills/gmgn-config/SKILL.md — all logic now lives in CLI source
- Simplify BEFORE RUNNING ANY COMMAND in all 6 SKILL.md files to two CLI commands, no duplicated text
- Remove stale First-time setup sections (openssl-based) from all 6 SKILL.md files
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add skills/gmgn-config/SKILL.md with complete setup flow: key pair
generation, credential writing, and verification via track follow-wallet.
Verification result is output in the user's conversation language.
- Simplify all 6 SKILL.md BEFORE RUNNING ANY COMMAND to one line that
delegates to gmgn-config skill, removing duplicate logic.
- Remove locale detection from CLI — output only the link; Agent handles
all user-facing guidance in the conversation language.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Use node -e to write GMGN_API_KEY and GMGN_PRIVATE_KEY into .env —
node is guaranteed to be present since gmgn-cli requires Node.js.
Also clarify that the same config step applies when the user explicitly
runs gmgn-cli config and sends back an API Key.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace awk+echo with python3+printf to correctly serialize the PEM
private key as a single-line \n-escaped value when writing to .env.
The awk approach produced multi-line output that broke .env parsing.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add a new `gmgn-cli config` command that automates Ed25519 key pair
generation for new users. The command reuses an existing keypair.pem if
present, or generates a new one, then outputs a pre-filled API Key
creation link with the public key embedded. Guidance text is output in
the user's system locale (zh-CN, zh-TW, or English).
All 6 SKILL.md files are updated with a BEFORE RUNNING ANY COMMAND
block that detects missing GMGN_API_KEY, triggers gmgn-cli config, and
instructs the Agent to write both GMGN_API_KEY and GMGN_PRIVATE_KEY
into ~/.config/gmgn/.env once the user provides their API Key.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
quote endpoint downgraded to exist auth (API Key only); from_address
no longer needs to match the key's bound wallet. Update all auth
references in cli-usage.md, SKILL.md, and CLAUDE.md.
Update Readme.md, Readme.zh.md, src/commands/swap.ts and cooking.ts
with integer 0–100 slippage examples (e.g. 30 = 30%) to match the
updated API validation and skill docs.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add full sub-tables for list[], condition_orders[], order_statistic,
and sell_param objects in the `order strategy list` response section.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Replace "trading bot" with user-facing language throughout SKILL.md
and cli-usage.md
- Mark --auto-fee and --sell-ratio-type as "Only with --condition-orders"
in swap and multi-swap parameter tables
- TRADING_BOT_UNAVAILABLE error now describes the symptom, not the
internal service name
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Move `order gas-price` → `gmgn-cli gas-price` (top-level command)
- Expand chain support to include sol alongside eth / bsc / base
- Reorder commands in swap.ts to match SKILL.md: swap → multi-swap →
order quote/get → gas-price → order strategy create/list/cancel
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add Chain column to swap, multi-swap, and strategy-create parameter
tables in SKILL.md and cli-usage.md, explicitly scoping each fee flag
to its supported chain(s)
- Reorder SKILL.md sections to follow Sub-commands table order: swap →
multi-swap → order quote → order get → order gas-price →
order strategy create/list/cancel
- Group each command's Usage + Parameters + Response Fields together
- Add horizontal dividers between command groups for readability
- Add order get cross-reference to shared swap response fields
- Collapse separate strategy usage examples into their respective command sections
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add --gas-level (eth only), --auto-fee (eth only) to swap, multi-swap,
and strategy create commands
- Add order gas-price subcommand (GET /v1/trade/gas_price, normal auth)
- Add --max-fee-per-gas / --max-priority-fee-per-gas to strategy create
- Remove --auto-tip-fee and --max-auto-fee from swap and multi-swap
- Update token SKILL.md: price field is now a nested object (price.price),
add price window fields and fee_distribution object docs
- Update EIP-1559 chain coverage from Base-only to BSC/BASE/ETH
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
AI models may use incorrect currency addresses from training data (e.g.
So11111111111111111111111111111111111111111 vs the correct ...112), causing
silent failures or misleading "jupiter has no route" errors. Added a warning
above the table and wrapped all addresses in backticks for clarity.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add ETH chain support to all P0 commands across CLI and SKILL.md docs:
Commands with ETH support added:
- token info/security/pool/holders/traders
- market kline/trending
- portfolio info/holdings/activity/stats/token-balance
- track follow-wallet
- swap, order quote/get
P1/P2 commands remain sol/bsc/base only:
- track kol/smartmoney (P1)
- multi-swap, order strategy create/list/cancel (P1)
- portfolio created-tokens (P2)
Also adds ETH chain currencies, explorer links, and gas price bounds
to gmgn-swap SKILL.md.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Shorten all 6 descriptions to 60-80 words with high-value terms in the
first 50 words (highest embedding weight). Add "crypto", "meme coin",
"meme token" where missing. Remove redundant chain-name repetition in
"Use when" sections. Keeps discriminating boundary hints (e.g. gmgn-track
→ gmgn-portfolio redirect for single-wallet queries).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Surface key features upfront: buying/selling meme coins, multi-wallet
trading, trailing stop loss, and trailing take profit — so clawhub.ai
skill search matches more user intents precisely.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Rewrite description fields across all 6 skills to follow a consistent
"Get [capabilities] via GMGN API. Use when user asks for [intents]."
pattern, aligned with how Openclaw agents search clawhub.ai. Adds
natural-language intent keywords (price, market cap, holder list,
Smart Money, KOL trades, copy-trading, etc.) so skills surface higher
in skill-search results.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add POST /v1/trade/multi_swap support: new MultiSwapParams interface,
multiSwap() method, and multi-swap CLI command with full options
(accounts, input/output amounts, slippage, fees, condition-orders, etc.)
- Fix track follow-wallet: switch from criticalRequest to normalRequest;
--wallet is now optional (API Key's bound user resolves the follow list)
- Update SKILL.md, cli-usage.md, Readme.md, Readme.zh.md to reflect both changes
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add order strategy list (with required --group-tag) and order strategy
create (with required --order-type) to the frontmatter argument-hint,
reflecting newly required parameters added after 2026-04-07.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace top-level filled_input_amount/filled_output_amount with the
report object returned when state=30 and status=successful. Document
all report fields (amounts, tokens, decimals, price, gas) and update
order polling, post-swap receipt template, and cooking status polling
to reference report.input_amount / report.output_amount.
ClosesGMGNAI/gmgn-skills#34
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Mark --group-tag as required (LimitOrder or STMix)
- Add usage examples: STMix for condition orders, LimitOrder for limit orders
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add drawdown_rate optional field to StrategyConditionOrder interface
- Make price_scale optional (required only for fixed-price types)
- Update --condition-orders help text with trace type example
- Document all 4 condition order types in SKILL.md with field requirements,
drawdown_rate semantics, and usage examples
- Sync order strategy create params: replace --side / auto-inference with
explicit --order-type and --sub-order-type required options
- Add --group-tag to order strategy list params
- Add --order-type to order strategy cancel params
- Fix --gas-price description: gwei (not wei); CLI converts internally
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Redefine price_scale: profit_stop uses gain % from entry (e.g. "100" = +100% / 2×), loss_stop uses drop % from entry (e.g. "65" = drops 65%)
- Update all condition-order examples in SKILL.md and both READMEs accordingly
- Add is_anti_mev recommended note and anti-mev flag to swap examples
- Add order strategy create to Financial Risk Notice
- Fix response section heading format (bold → ###) for order strategy create/list
- Add reset_at field extraction guidance to Rate Limit Handling in all 6 skills
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add "Swap with Take-Profit / Stop-Loss Orders" section to Readme.md and Readme.zh.md
with hold_amount and buy_amount mode examples (TP at +100%/+300%, SL at -65%)
- Reorder CLI Reference section: basic Swap moved before TP/SL examples
- Update SKILL.md condition-orders examples: add stop-loss at -65%, bump slippage to 0.3,
add note that hold_amount includes any added positions at trigger time
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add --condition-orders parameter with max-10-sub-orders note and best-effort strategy behavior
- Add --sell-ratio-type with detailed explanation of buy_amount vs hold_amount semantics
- Add ConditionOrder sub-table (order_type, side, price_scale, sell_ratio) with supported types
- Add two full CLI examples: hold_amount (sell 50% at 2x, remaining 50% at 4x) and buy_amount (fixed ratio each trigger)
- Add strategy_order_id to swap response fields
- Update --sell-ratio-type description in order strategy create section
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove --open-price option from swap order strategy create command
- Remove open_price field from OpenApiClient StrategyCreateParams type
- Update skills/gmgn-swap/SKILL.md: drop open-price row and inference table, simplify examples to use --sub-order-type directly
- Update docs/cli-usage.md: remove --open-price from command signature and parameter table
- Add /gmgn-cooking skill to Skills tables in Readme.md and Readme.zh.md
- Add limit order and cooking CLI examples to section 8 of both readmes
- Update Cline install instructions to include /gmgn-cooking
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
David Lau