The four gates were one flat "any single failure means no order" list, but they
answer two different questions. Volume, depth and security answer "can I get
back out once I am in" — structural facts that do not flip within hours.
Direction and volatility answer "where will a market order fill this second" —
which changes minute by minute. Merging them makes the same token get opposite
verdicts on the same day.
Measured: VC on BSC (0x36f01746a86639d0c3b6a850d328be1b634a4444) scored 91.4
"buyable" from gmgn-contract-dd, one-sided depth $91,442, 95% of LP burned to
the black hole, $6.6M 24h volume, 2,560 holders, zero taxes, owner renounced —
and was still reported as "not recommended" purely because 5m was -8.2% and all
three net-flow windows were negative. Two separate rules produced that: the
compound hard rule (three windows negative AND 5m drawdown >= 5%), and the
sentence that merged this section's warnings into the security section's
">= 2 warnings fails" count.
Section 三 now has three exits instead of two: 5m drawdown >= 10% remains the
one hard stop (a market order genuinely cannot execute there), everything else
downgrades execution — the order card is still produced, but it must name the
degraded execution path. Added a table of the three downgrade actions so none
of them can be given by feel: the limit trigger price is derived as
price.price * (1 - |5m drawdown|) and handed to gmgn-swap as
`order strategy create --order-type limit_order --sub-order-type buy_low
--check-price <price>`; waiting names the condition that has to converge (5m
drawdown back inside 5%, or buy_volume_5m - sell_volume_5m turning positive);
reducing size reuses the existing price-impact wording. The downgrade needs its
own separate confirmation — nodding yes to buying a token is not the same as
knowing you are no longer getting a market order.
Direction now produces no veto count at all, and missing direction data
downgrades to the strictest tier rather than failing the order: not being able
to read direction is not the same as a quiet market.
Nothing about the original intent is relaxed. The slippage formula is
untouched (its |5m change| * 0.5 term already prices volatility), the
>= 100x-with-negative-flow warning still refuses to widen slippage, and the
security gate's ten warnings and red flags are unchanged.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
gmgn-dev-score landed upstream 18 minutes after this branch's last commit,
so its buy-intent phrases were never reconciled with this skill's. Both
claim a buy decision; the subject differs. This skill's subject is a COIN
("PENGU 能不能买"), dev-score's is the PERSON who launched it ("这个 dev 的
新盘能不能买", "should I buy his next launch"). A launcher question carries no
token name to resolve and no amount to size, which is everything this skill
does, so it goes to dev-score and comes back here once the user names the
coin.
Adds that clause to the description and one 与 gmgn-dev-score 的分工 line to
the boundaries section. Description 1990 -> 2299 chars (dev-score's own is
2300). Nothing else changed.
Borrows the workflow layout from DefiLlama's token-research skill
(DefiLlama/defillama-skills, token-research/SKILL.md): every step states the
command to run right at the step, then the fields it reads, then its exit
condition — instead of listing all four commands up top and describing them
in prose further down.
- `## Run` opens with a four-row overview table (step / what it does / what it
runs / its exit), so the whole gated flow is visible at a glance, and states
the invariant the old text left implicit: each step IS a gate, and a step
that does not pass never reaches the next one
- each `### 第 N 步` now leads with **跑什么** (a fenced command), **关键字段**
(what to read, pointing at references/fields.md), **出口** (continue on what,
stop on what) before the reasoning prose
- step headings name the action: 名字解析成唯一合约 / 三道硬性筛选（量 / 深度 /
安全）/ 组装订单卡并请求确认; 筛选未通过时 → 任一闸门未通过时
- drops the lead sentences the command blocks made redundant, and the
restatement of the 7-chain boundary inside step 0
No threshold, field or routing boundary changed.
The skill was one 369-line file with the command reference, the field
mappings and the whole threshold table inlined as two appendices, and no
fixed shape for the order card. gmgn-dev-score is the template every skill
in this repo follows, so adopt its skeleton:
- description becomes a `>-` block scalar (same content, now readable)
- add the three preamble notices every other skill has and this one was
missing: `config --check`, only ever `gmgn-cli` (no web search / WebFetch
/ curl / gmgn.ai), and IPv6 is unsupported
- `## Run` — the four read commands, the fixed 4-request budget, the 7-chain
boundary, and the fact that the CLI only returns numbers: the report is
written by the model, in the user's language
- `## 订单卡必须说到的东西` — a checklist of what must be *said*, each item
naming the field it reads
- `## Display Templates` — the order card's shape is now fixed (8 sections,
when each may be omitted) with the wording left free, replacing the old
space-padded ASCII block with emoji ticks. Same formatting rules as
dev-score: plain ascii dollar sign, one decimal on percentages, no emoji,
no column padding, bold only where named
- `## Rules` — the three hard rules plus the three that follow from the
7-chain boundary, the hostile-metadata rules, and the report-is-the-whole-
answer / never-state-a-number-the-fields-do-not-carry rules
- `## References` — appendix A moves to references/fields.md, appendix B to
references/thresholds.md, and 常见错误 to references/pitfalls.md
No threshold, field mapping or routing boundary changed value; SKILL.md goes
from 369 to 258 lines with the moved text intact in the three reference
files.
gmgn-swap's own description says "Use when user asks to buy, sell, or swap a
token" with no qualifier, and carries a [FINANCIAL EXECUTION] label. This
skill answered that by asserting a plain buy request "is MINE by default",
which is a claim about precedence and gives a reader nothing to check.
Replace the assertion with the two facts that actually decide it. First, the
two skills are not after the same outcome: gmgn-swap signs and submits, this
skill holds no private key and places no order, so a vetted buy ends AT
gmgn-swap by design. Second, gmgn-swap cannot start from a name either — its
--output-token takes a contract address and the only names it resolves are
the SOL/BNB/ETH/USDC currencies — so a request naming a token has to arrive
here whichever skill is asked first.
Then name what genuinely belongs to gmgn-swap instead of gesturing at it:
an explicit skip of the pre-buy check, and everything this skill does not do
at all — selling, percentage sells, limit orders, stop loss, take profit,
trailing orders, multi-wallet batch trading, order status, gas-price lookups.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The description claimed gmgn-contract-dd "only look[s] up an address and
return[s] no verdict", which is false — it returns a 0-100 composite capped
by GMGN's own rug label — and it contradicted this skill's own body, which
already calls that skill for the safety verdict and defers to it on
disagreement.
It also claimed the bare phrase 能不能买, which gmgn-contract-dd claims
verbatim in its own description and its neighbouring-skills table. Both
skills can serve a bare address, so the phrase alone cannot route.
Split the trigger by whether a buy is being prepared instead: a NAME or
symbol to resolve, or an AMOUNT to size, is this skill — neither of which
gmgn-contract-dd can accept, since it has no search step and no amount
parameter. A bare address with neither is a verdict ask, and taking it
would hand the user an order card he never asked for.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
guess a contract when `market search` is unavailable
Two changes, both driven by running the skill for real rather than only
measuring routing.
1. The safety verdict now names `gmgn-contract-dd` as the owner.
This skill and `gmgn-contract-dd` were computing two parallel safety
verdicts on the same contract. Step 2 now states that once step 1 has
resolved the one right contract, the 0-100 composite is
`gmgn-contract-dd`'s job — its deductions are finer and each one names
the field it read — and that its score and red flags are taken as this
step's result, with its verdict winning any disagreement.
The local gates are kept as an explicitly-labelled fallback rather
than deleted, because a live run shows the hand-off does not fire:
two real queries, Bash restricted to `gmgn-cli`, and
`gmgn-contract-dd` was invoked in neither. That matches the earlier
arm-Z result (a hand-off written into a skill body, 20 cases,
0 invocations). So the fallback is the path that actually executes
today; deleting the local gates would have removed the safety verdict
without connecting the replacement. The fallback thresholds are
unchanged, and the order card must say the verdict was computed
locally without `gmgn-contract-dd` review.
2. A hard stop when `gmgn-cli market search` is missing.
The released CLI has no `market search` — that command is added by
this PR's `aa0e7fd`. On a machine with the released CLI the live run
showed the model improvise: `market search` failed, and it moved on to
`market hot-searches --limit 500`, `market trending`, `market trenches`
to find the token by name. Those are popularity and gain rankings, not
a name index, so resolving a name through them lands on whatever is
being pumped — which is exactly the copycat this skill exists to rule
out. Step 1 now stops on `unknown command 'search'`, names the three
commands that must not be substituted, and tells the user to upgrade
the CLI or supply the address directly.
Routing unchanged by all of the above: 16/16 on the 16 plain-buy cases
(11/11 recall, 100% precision) and 18/20 on the 20 due-diligence cases
(8/10 recall, 0 false positives), measured on the real installed state.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The description implied exclusivity by describing what the siblings
cannot do; it never said it directly, so the router had to compose two
clauses to reach it. States it in the first sentence instead.
Measured neutral, not an improvement: on the real installed state
(12 skills + the routing table) the arm with this clause scores exactly
what the arm without it scores — 16/16 on the 16 plain-buy cases
(11/11 recall, 100% precision) and 17/20 on the 20 due-diligence cases
(7/7 on the runnable positives, 0 false positives). Kept for the reader,
not for the router.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Measured on the novice phrasing the skill actually targets — a plain
"我想买 200u 的 PENGU" with no due-diligence and no skip-the-checks
wording. Four arms, 16 cases (11 positives / 5 negatives), one live
`claude -p` session per case:
arm recall precision score
user's machine today (no CLAUDE.md) 3/11 27% 100% 8/16
+ the 11-line routing table 8/11 73% 100% 13/16
repo skills + the 11-line table 11/11 100% 92% 15/16
+ these 5 lines 11/11 100% 100% 16/16
Three changes:
- CLAUDE.md: the `gmgn-swap` registry row claimed `"buy this token"`
unconditionally. The earlier fix only narrowed the quick-route table,
not the registry, so a plain buy request still had a competing claim.
- CLAUDE.md: one quick-route row making `gmgn-token-buy` the explicit
DEFAULT for any plain buy request. The failure mode being fixed is
silence, not theft — every miss in the 8/11 arm was "no skill fired".
- SKILL.md description: lead with the plain phrasings, and state that a
plain buy request is this skill's by default rather than framing the
boundary defensively around what it hands to gmgn-swap.
Also adds a hard boundary for sells, limit orders and order-status
queries, which fixes the one false positive in the 15/16 arm
("帮我挂个 BONK 的限价单" bounced from gmgn-swap into this skill).
Negatives hold in every arm: "直接买 200u 的 BONK，不用检查了" routes to
gmgn-swap, never here — an explicit skip-the-checks instruction must not
be intercepted.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Covers the request shape no existing skill can serve: the user names a
token and wants to know whether to buy it, and for how much. Every other
token skill takes a contract address as input, so none of them can start
from "搜一下 PENGU 能不能买" or "帮我买 200u 的 XX".
The skill resolves the name to the one correct contract among its
copycats, runs three hard gates (24h volume / pool depth / security
audit), sizes slippage and gas for the stated amount, and emits an order
card. It never holds a private key and never submits a transaction: after
the user confirms in-conversation, the parameters go to gmgn-swap. That
confirmation is required even when the user has said "don't ask, just
buy" — it is a real spend of real funds.
All data access goes through gmgn-cli, so the skill reads, stores and
transmits no credentials, and it inherits the output sanitiser that
src/sanitize.ts applies in printResult. What the sanitiser does not cover
— identity confusion and gate-softening prose in attacker-written token
metadata — the skill handles in its own section: metadata is data and
never an instruction, a "sanitized N field(s)" notice is itself a risk
signal that belongs in the order card, an official-looking name never
skips contract locking, and a contract address is only ever read from the
address field, never from prose.
Verifying the rules against the live API corrected five of them, each of
which would have misjudged a blue chip:
- pool.base_reserve_value can be "0" on a fully liquid token (BONK's
meteora_dlmm pool reports base "0" while holding 14.7B tokens), so
min(base, quote) scored a 996k-holder token at $0 depth. The gate now
falls back to pool.liquidity / 2.
- pool.liquidity is twice ONE side and which side is unpredictable:
PEPE/SHIB/BONK/PENGU/BRETT are 2 x quote, CAKE is 2 x base.
- pool is not necessarily the deepest pool — BONK's
biggest_pool_address differs from pool.pool_address — so depth is a
lower bound, and volume far above depth means "there are other
pools", not wash trading.
- creation_timestamp and created_at can be 0 (real BONK returns 0 for
both), which naive arithmetic turns into 56 years of history. Zero
means unknown; skip the age bonus instead of crediting it.
- Solana's *_prio_fee is a placeholder 1 while BSC's is legitimately 0,
and a tier is not reconstructible from suggest_base_fee + prio (BSC
high is 561M wei against a 120M base fee). The tier field itself is
the authoritative all-in price; only *_prio_fee_mixed is real.
Routing was measured with all 12 skills installed: precision is 100% (no
false trigger in 10 negatives), but recall is low and two full
description rewrites moved it only within run-to-run noise. The
attribution is stable — gmgn-token takes 4-5 of the misses every run,
because its own description ends with "or wants due diligence before
buying", which is this skill's whole job stated in 429 characters. That
overlap is structural rather than cosmetic and gmgn-token is deliberately
left untouched here; see the PR description.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
