Address HackenProof report GMGNWM-143, where attacker-controlled token metadata
could hijack an AI agent driving gmgn-cli into executing an unauthorized trade.
Move guardrails from overridable SKILL.md text into code.
- Add src/sanitize.ts: neutralize prompt-injection framing and hidden/control
characters in API output (via printResult) and validate create-token metadata
- Add src/confirm.ts: code-enforced human confirmation for financial writes
(swap, multi-swap, order strategy create, cooking create) — reads a typed
"yes" from /dev/tty; automation requires GMGN_ALLOW_AUTOMATED_TRADES=1 + --yes
- Harden config.ts: tighten ~/.config/gmgn/.env to 0600 and warn if world-readable
- Update SKILL.md files, Readme.md and Readme.zh.md to document the gate,
the --yes flag, and untrusted-metadata handling
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
GET /v1/trade/follow_wallet requires X-Signature (critical auth) but was
called via normalRequest (API Key only), causing HTTP 401 AUTH_INVALID
with "missing signature".
- OpenApiClient: getFollowWallet now calls criticalRequest; criticalRequest
queryExtra type widened to accept string[] to support the --filter option
- signer: buildMessage handles string[] values as sorted repeated k=v pairs,
consistent with buildUrl / URLSearchParams serialization
- config: update PRIVATE_KEY_REQUIRED_MSG to include follow-wallet
- SKILL.md: prerequisites note GMGN_PRIVATE_KEY for follow-wallet; first-time
setup now saves private key to ~/.config/gmgn/.env and removes /tmp copy;
Notes section corrected to reflect split auth modes
- CLAUDE.md: Auth Modes table updated — follow-wallet moved to Critical row
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
