Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add GMGNAI/gmgn-skills --skill gmgn-cookinggit clone --depth 1 https://github.com/GMGNAI/gmgn-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gmgnai/gmgn-skills/gmgn-cooking)<a href="https://agentmods.dev/skills/gmgnai/gmgn-skills/gmgn-cooking"><img src="https://agentmods.dev/badge/skills/gmgnai/gmgn-skills/gmgn-cooking/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gmgnai/gmgn-skills/gmgn-cooking"><img src="https://agentmods.dev/badge/skills/gmgnai/gmgn-skills/gmgn-cooking.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket warn
- Snyk fail
- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 96 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 96 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Excessive Agency · line 41 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 211 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00111 | $0.11727 |
| Opus 5 | $0.00056 | $0.05863 |
| Sonnet 5 | $0.00022 | $0.02345 |
| Haiku 4.5 | $0.00011 | $0.01173 |
Grade A, and why
gmgn-cooking scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
**IMPORTANT: Always use `gmgn-cli` commands below. Do NOT use web search, WebFetch, curl, or visit gmgn.ai — all token creation operations must go through the CLI. The CLI handles signing and submission automatically.** How it starts
The opening of the file, as written. The whole thing — 697 lines — stays where its author put it; the contents beside it link to each section on GitHub.
BEFORE RUNNING ANY COMMAND: Run gmgn-cli config --check. If exit code is 0, proceed normally. If exit code is 1, (1) run gmgn-cli config and show the output to the user; (2) once the user sends the API Key, run gmgn-cli config --apply <KEY> to complete configuration and verification, then show the output to the user. If --check returns an error (unknown option or command not found), tell the user to run npm install -g gmgn-cli to update, then retry.
IMPORTANT: Always use gmgn-cli commands below. Do NOT use web search, WebFetch, curl, or visit gmgn.ai — all token creation operations must go through the CLI. The CLI handles signing and submission automatically.
IMPORTANT: Do NOT guess field names or values. When a field's meaning is unclear, look it up in the Response Fields sections below before using it.
⚠️ IPv6 NOT SUPPORTED: If you get a 401 or 403 error and credentials look correct, check for IPv6 immediately: (1) list all network interfaces and their IPv6 addresses — run ifconfig | grep inet6 (macOS) or ip addr show | grep inet6 (Linux); (2) send a test request to https://ipv6.icanhazip.com — if the response is an IPv6 address, outbound traffic is going via IPv6. Tell the user immediately: "Please disable IPv6 on your network interface — gmgn-cli commands only work over IPv4."
Use the gmgn-cli tool to create a token on a launchpad platform or query token creation statistics per launchpad. Requires private key (GMGN_PRIVATE_KEY in .env) for cooking create.
Core Concepts
-
Bonding curve — Most launchpad platforms (Pump.fun, FourMeme, Flap, etc.) launch tokens on an internal bonding curve. The token price rises as buyers enter. Once the threshold is reached, the token "graduates" to an open DEX (e.g. Raydium on SOL, PancakeSwap on BSC). Token creation happens on the bonding curve — not the open market.
-
--buy-amtis in human units —--buy-amtis expressed in full native token units, not smallest unit.0.01= 0.01 SOL.0.05= 0.05 BNB. Always confirm the human-readable amount with the user before executing. -
--dexidentifiers — Each launchpad has a fixed identifier passed to--dex. These are not free-form names — use only the identifiers listed in the Supported Launchpads table. Never guess a--dexvalue not in that table. -
Image input — Token logo can be provided as base64-encoded data (
--image, max 2MB decoded) or a publicly accessible URL (--image-url). Provide one or the other — not both. If the user gives a file path, read and base64-encode it before passing to--image. If they give a URL, use--image-urldirectly. -
Status polling via
order get—cooking createis asynchronous. The immediate response may showpending. Poll withgmgn-cli order get --chain <chain> --order-id <order_id>untilconfirmed. The new token's contract address is in thereport.output_tokenfield of theorder getresponse, not in the initial create response. -
Signed auth —
cooking createrequires bothGMGN_API_KEYandGMGN_PRIVATE_KEY. The private key never leaves the machine — the CLI uses it only for local signing.cooking statsuses exist auth (API Key only). -
Slippage — The initial buy is executed as part of the same transaction as token creation. Slippage applies to that buy. Use
--slippage(integer 0–100, e.g.30= 30%) or--auto-slippage. One of the two is required when--buy-amtis set.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 697 lines · 111 tokens per session scan A b3ad3ab6295d
gmgn-cooking is a skill published in the GitHub repository GMGNAI/gmgn-skills (522 stars, last pushed today), licensed MIT. It adds 111 tokens to every session and 11,727 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
coingecko-api
Broad crypto market data from CoinGecko covering 13,000+ tokens. Global market stats, historical price data going back years, exchange volumes, trending tokens, and category filters. Best for macro analysis and long-term historical data.
market-sentiment
Synthesize crypto market sentiment by combining the Fear & Greed index, trending coins, narrative momentum, whale activity, and on-chain signals into a single actionable market read. Use when the user wants to know if the market is bullish, bearish, or transitioning. Powered by the free-crypto-news API.
rug-pull-news-check
Use news coverage, community signals, and on-chain reporting to assess whether a crypto project shows signs of being a scam, rug pull, or exit scam. Supplements contract-level analysis with news intelligence. Use when the user asks if a project is legitimate or wants a credibility check before investing.
alien-plugg-x402
38 paid x402 API endpoints for AI agents — Zora crypto analysis, Robinhood Chain tokenized stocks, on-chain intelligence, whale tracking, and utilities. MCP-compatible. Flat $0.003/call via USDC micropayments on Base.
fastapi-best-practices
Use this skill when creating or modifying Python backend services with FastAPI. It defines API design, security, and testing standards.
trading-signals
Fetches live AI crypto trading signals with entry price, stop-loss, take-profit, leverage, confidence scores, and automated verification. Covers 50+ coins including BTC, ETH, SOL. Use when the user asks for crypto signals, trade ideas, market direction, portfolio analysis, or wants to build a trading bot.