Give operators/agents visibility into when the CLI neutralizes suspicious token
metadata in an API response.
- sanitizeForOutputWithCount returns the cleaned value plus the number of altered
strings; sanitizeForOutput kept as a thin wrapper
- printResult prints "[gmgn-cli] Notice: neutralized N suspicious metadata value(s)"
to stderr when anything was filtered (extra detail under GMGN_DEBUG); sanitized
JSON still goes to stdout so piping is unaffected
- document the notice in the gmgn-token SKILL untrusted-data warning
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Address HackenProof report GMGNWM-143, where attacker-controlled token metadata
could hijack an AI agent driving gmgn-cli into executing an unauthorized trade.
Move guardrails from overridable SKILL.md text into code.
- Add src/sanitize.ts: neutralize prompt-injection framing and hidden/control
characters in API output (via printResult) and validate create-token metadata
- Add src/confirm.ts: code-enforced human confirmation for financial writes
(swap, multi-swap, order strategy create, cooking create) — reads a typed
"yes" from /dev/tty; automation requires GMGN_ALLOW_AUTOMATED_TRADES=1 + --yes
- Harden config.ts: tighten ~/.config/gmgn/.env to 0600 and warn if world-readable
- Update SKILL.md files, Readme.md and Readme.zh.md to document the gate,
the --yes flag, and untrusted-metadata handling
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add robinhood as a supported chain across the CLI and skills, and stop
advertising chains that are not publicly supported yet.
robinhood:
- validate.ts: add to VALID_CHAINS and treat as EVM for address checks
- reject guards for commands that do not support it: track kol,
track smartmoney, cooking create (mirrors market signal)
- --chain help updated for supported commands (token/portfolio/swap/
market kline·trending·trenches·hot-searches/track follow-*/order get/
gas-price); OpenApiClient chain comment
- docs: all SKILL.md, Readme.md, Readme.zh.md (split-out row for
unsupported commands), cli-usage.md, plugin/marketplace descriptions
disable monad/megaeth/hyperevm/tron:
- comment monad out of VALID_CHAINS (kept for quick re-enable)
- strip these chains from all --chain help, SKILL.md, cli-usage.md
(hot-searches default now 4 chains: sol/bsc/base/eth)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Add gmgn-cli config --check: pure local check for GMGN_API_KEY, exit 0 = found, exit 1 = not found
- Update BEFORE RUNNING ANY COMMAND in all 6 SKILL.md files to use --check instead of file path detection
- Add fallback instruction for outdated gmgn-cli versions (unknown option → prompt user to npm install -g gmgn-cli)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- gmgn-cli config: add multi-language guidance (zh-CN/zh-TW/en) based on system locale
- gmgn-cli config --apply <key>: write GMGN_API_KEY + GMGN_PRIVATE_KEY to ~/.config/gmgn/.env and verify via track follow-wallet
- Delete skills/gmgn-config/SKILL.md — all logic now lives in CLI source
- Simplify BEFORE RUNNING ANY COMMAND in all 6 SKILL.md files to two CLI commands, no duplicated text
- Remove stale First-time setup sections (openssl-based) from all 6 SKILL.md files
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add skills/gmgn-config/SKILL.md with complete setup flow: key pair
generation, credential writing, and verification via track follow-wallet.
Verification result is output in the user's conversation language.
- Simplify all 6 SKILL.md BEFORE RUNNING ANY COMMAND to one line that
delegates to gmgn-config skill, removing duplicate logic.
- Remove locale detection from CLI — output only the link; Agent handles
all user-facing guidance in the conversation language.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Use node -e to write GMGN_API_KEY and GMGN_PRIVATE_KEY into .env —
node is guaranteed to be present since gmgn-cli requires Node.js.
Also clarify that the same config step applies when the user explicitly
runs gmgn-cli config and sends back an API Key.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace awk+echo with python3+printf to correctly serialize the PEM
private key as a single-line \n-escaped value when writing to .env.
The awk approach produced multi-line output that broke .env parsing.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add a new `gmgn-cli config` command that automates Ed25519 key pair
generation for new users. The command reuses an existing keypair.pem if
present, or generates a new one, then outputs a pre-filled API Key
creation link with the public key embedded. Guidance text is output in
the user's system locale (zh-CN, zh-TW, or English).
All 6 SKILL.md files are updated with a BEFORE RUNNING ANY COMMAND
block that detects missing GMGN_API_KEY, triggers gmgn-cli config, and
instructs the Agent to write both GMGN_API_KEY and GMGN_PRIVATE_KEY
into ~/.config/gmgn/.env once the user provides their API Key.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add usage context to fee_distribution section so agents know to use
token info when querying claim status and royalty allocation
- Fix incorrect Note that said trading volume is not in token info;
price.volume_{window}, buys_{window}, sells_{window}, swaps_{window}
are all available in the token info price object
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
native_transfer records the first native token (SOL/BNB/ETH) transfer into a
wallet, not the most recent — it indicates the original funding source. Wallets
sharing the same native_transfer.address are likely funded from a common origin
(coordinated wallets / same operator).
Move it out of Last Transaction Records into its own Shared Funding section to
reflect its distinct purpose.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add --gas-level (eth only), --auto-fee (eth only) to swap, multi-swap,
and strategy create commands
- Add order gas-price subcommand (GET /v1/trade/gas_price, normal auth)
- Add --max-fee-per-gas / --max-priority-fee-per-gas to strategy create
- Remove --auto-tip-fee and --max-auto-fee from swap and multi-swap
- Update token SKILL.md: price field is now a nested object (price.price),
add price window fields and fee_distribution object docs
- Update EIP-1559 chain coverage from Base-only to BSC/BASE/ETH
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
These fields were removed from the TokenStatData struct in the openapi-service
and are no longer returned in the token info response.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add ETH chain support to all P0 commands across CLI and SKILL.md docs:
Commands with ETH support added:
- token info/security/pool/holders/traders
- market kline/trending
- portfolio info/holdings/activity/stats/token-balance
- track follow-wallet
- swap, order quote/get
P1/P2 commands remain sol/bsc/base only:
- track kol/smartmoney (P1)
- multi-swap, order strategy create/list/cancel (P1)
- portfolio created-tokens (P2)
Also adds ETH chain currencies, explorer links, and gas price bounds
to gmgn-swap SKILL.md.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Shorten all 6 descriptions to 60-80 words with high-value terms in the
first 50 words (highest embedding weight). Add "crypto", "meme coin",
"meme token" where missing. Remove redundant chain-name repetition in
"Use when" sections. Keeps discriminating boundary hints (e.g. gmgn-track
→ gmgn-portfolio redirect for single-wallet queries).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Rewrite description fields across all 6 skills to follow a consistent
"Get [capabilities] via GMGN API. Use when user asks for [intents]."
pattern, aligned with how Openclaw agents search clawhub.ai. Adds
natural-language intent keywords (price, market cap, holder list,
Smart Money, KOL trades, copy-trading, etc.) so skills surface higher
in skill-search results.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add dev nested object table to Response Field Reference with all 21 fields
(creator wallet, DEXScreener activity, CTO flag, funding source, etc.)
- Update nested objects description to include dev as the 5th object
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Redefine price_scale: profit_stop uses gain % from entry (e.g. "100" = +100% / 2×), loss_stop uses drop % from entry (e.g. "65" = drops 65%)
- Update all condition-order examples in SKILL.md and both READMEs accordingly
- Add is_anti_mev recommended note and anti-mev flag to swap examples
- Add order strategy create to Financial Risk Notice
- Fix response section heading format (bold → ###) for order strategy create/list
- Add reset_at field extraction guidance to Rate Limit Handling in all 6 skills
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Each skill now guides the AI Agent through full credential setup when
GMGN_API_KEY is not configured: generate Ed25519 key pair, show public
key to user with instructions to apply at https://gmgn.ai/ai, wait for
API key, then write to ~/.config/gmgn/.env.
- gmgn-token / gmgn-market / gmgn-portfolio: API key setup only
- gmgn-track: API key + optional private key for follow-wallet
- gmgn-swap: both API key and private key required from the start
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GMGN API does not support IPv6. When a 401/403 error occurs and
credentials look correct, AI agents and users now have a clear
two-step diagnostic: list inet6 interfaces, then probe
ipv6.icanhazip.com to confirm whether outbound traffic is IPv6.
If confirmed, the instruction is to disable IPv6 immediately.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace the 10-line placeholder with a complete field reference based
on actual API output, grouped into Identity & Holdings, Trading Summary,
Cost & P&L, Transfer History, Timing, Wallet Identity, and Last
Transaction Records sections.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove hardcoded "renowned" default from --tag in `token holders` command
- Remove hardcoded "renowned" default from --tag in `token traders` command
- Update skills/gmgn-token/SKILL.md to show --tag has no default (returns all wallets when omitted)
Fixes#14
- Add IPv6 not supported warning to all 5 SKILL.md headers
- Add detailed `track follow-wallet` response field reference based on actual API output
- Fix `--tag` default value to empty in gmgn-token SKILL.md
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace `npm install -g gmgn-cli@1.1.0` with `npm install -g gmgn-cli`
across all SKILL.md files and CLAUDE.md, so users always install the
latest published version instead of a pinned one that may lack newer
commands (e.g. track).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add new `track` command group with three sub-commands:
- `track follow-wallet`: monitor trade activity of followed wallets (critical auth)
- `track kol`: KOL trade records with optional --chain and client-side --side filter
- `track smartmoney`: Smart Money trade records with optional --chain and client-side --side filter
- Remove follow-wallet, kol, smartmoney sub-commands from portfolio
- Add getKol/getSmartMoney optional chain param in OpenApiClient
- Switch getFollowWallet to criticalRequest (signature auth required)
- Align track follow-wallet options to actual API params (remove unsupported flags)
- Add skills/gmgn-track/SKILL.md with sub-command guide, options, response fields
- Add IMPORTANT notice to all SKILL.md files to prevent AI from scraping gmgn.ai
- Add CRITICAL RULE section to CLAUDE.md to enforce CLI-only data access
- Update Readme.md and Readme.zh.md: add gmgn-track skill, Track CLI section, user tip
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
David Lau