gmgn-cli 1.0.0 → 1.0.2

package/Readme.md

@@ -1,8 +1,16 @@
-# gmgn-cli
+<div align="center">
 
-> 中文文档：[Readme.zh.md](Readme.zh.md)
+<img src="static/gmgnagentskills.png" alt="GMGN Agent Skills" />
 
-GMGN AI skills for on-chain operations — token research, market data, wallet analysis, and swap.
+[![X](https://img.shields.io/badge/Follow-%40gmgnai-black?logo=x&logoColor=white)](https://x.com/gmgnai) [![Telegram](https://img.shields.io/badge/Telegram-gmgnagentapi-2CA5E0?logo=telegram&logoColor=white)](https://t.me/gmgnagentapi) [![Discord](https://img.shields.io/badge/Discord-gmgnai-5865F2?logo=discord&logoColor=white)](https://discord.gg/gmgnai)
+
+English | [简体中文](Readme.zh.md)
+
+</div>
+
+## GMGN Agent Skills
+
+With GMGN Agent Skills, you can use AI agents to query real-time trending token rankings across multiple chains, token fundamentals, social media signals, live trading activity, new tokens in Trenches, top holders, top traders, smart money positions, KOL holdings, insider wallets, bundled wallet exposure, and other professional on-chain analytics. It also supports market orders, limit orders, advanced take-profit/stop-loss strategy orders, and wallet management — including real-time holdings, recent P&L, and transaction history — all through natural language.
 
 ---
 
@@ -15,50 +23,127 @@ GMGN AI skills for on-chain operations — token research, market data, wallet a
 | [`/gmgn-portfolio`](skills/gmgn-portfolio/SKILL.md) | Wallet holdings, activity, stats | [SKILL.md](skills/gmgn-portfolio/SKILL.md) |
 | [`/gmgn-swap`](skills/gmgn-swap/SKILL.md) | Swap submission + order query | [SKILL.md](skills/gmgn-swap/SKILL.md) |
 
+> For detailed CLI commands, parameters, and recommended values, see the [Wiki documentation](https://github.com/GMGNAI/gmgn-skills/wiki).
+
+### Quick Start
+
+Ready to install skills? [Jump to Installation →](#get-started)
+
 ---
 
-## Usage Examples
+## Demo Cases
 
-Natural language prompts you can send to any AI assistant with gmgn-cli skills installed:
+### Trending Token Rankings
+
+Send this prompt to your AI Agent:
 
 ```
-buy 0.1 SOL of <token_address>
-sell 50% of <token_address> on BSC
-check order status <order_id>
-is <token_address> safe to buy on solana?
-show top holders of <token_address>
-show my wallet holdings on SOL
-query token details for 0x1234...
-show trading stats for wallet <wallet_address> on BSC
+Fetch Solana 1h trending, filter for pump.fun tokens created within 6h, sort by volume descending.
+```
+
+![Trending Token Rankings](static/market-rank-1h-Pumpfun-en.png)
+
+### Real-Time Token Trading Analysis
+
+Send this prompt to your AI Agent:
+
 ```
+Check the first token's K-line, analyze entry timing, plot price + volume chart, and provide social media links and smart money/KOL trading analysis.
+```
+
+![Token Analysis 1](static/market-tokenanalysis-en01.png)
+![Token Analysis 2](static/market-tokenanalysis-en02.png)
 
 ---
 
-## Setup
+## Get Started
 
-### 0. Prepare
+Before installing, create your API Key at **https://gmgn.ai/ai**. The API key is used for:
 
-Before applying for an API Key, get two things ready:
+1. Read data: tokens, trending lists, K-line, and featured on-chain metrics
+2. Submit trades: market orders, limit orders, strategy orders, and more
 
-**Generate an Ed25519 key pair**
+---
 
-Download and run the [Binance Asymmetric Key Generator](https://github.com/binance/asymmetric-key-generator/releases). You will need the **public key** when filling out the API Key application, and the **private key** in your `.env` later (for swap / order).
+## 1. Installation
 
-**Get your public egress IP** (for the IP whitelist)
+Choose one of the following methods:
+
+### 1.1 Via Agent (recommended)
+
+Send this to your AI agent:
 
 ```bash
-curl ip.me
+npx skills add GMGNAI/gmgn-skills
+```
+
+### 1.2 npm Global Install
+
+```bash
+npm install -g gmgn-cli@1.0.2
+```
+
+### 1.3 Local Development
+
+```bash
+npm install
+npm run build
+node dist/index.js <command> [options]
+```
+
+## 2. Verify Connection
+
+### Option 1: Via AI Agent
+
+Send this prompt to your AI Agent:
+
+```
+Run this CLI command: GMGN_API_KEY=gmgn_solbscbaseethmonadtron npx gmgn-cli market trending --chain sol --interval 1h --limit 3
 ```
 
-Or visit **https://ip.me** in your browser.
+### Option 2: Via CLI
+
+Test with the public API key — no registration required:
+
+```bash
+GMGN_API_KEY=gmgn_solbscbaseethmonadtron gmgn-cli market trending --chain sol --interval 1h --limit 3
+```
 
-### 1. Get an API Key
+If you see JSON output, the CLI is working. The public key supports all read-only commands (token / market / portfolio). The public key is for testing only — apply for your own API key to use any feature (see step 3).
 
-Apply at **https://gmgn.ai/ai** — enter the public key and your IP address from the step above.
+## 3. Get Your Own API Key
 
-### 2. Configure
+The public key in step 2 is for testing only. Apply for your own API key at **https://gmgn.ai/ai** — required for all actual use (read-only and swap). You will need:
 
-**Option A — Global config (recommended)**
+### 3.1 Generate an Ed25519 Key Pair
+
+**Option 1 — Ask your AI agent (recommended)**
+
+Send this prompt to your agent:
+
+```
+Generate an Ed25519 key pair for me using OpenSSL and show me:
+1. The public key (I need to fill it in the GMGN API Key application form)
+2. The private key in PEM format (I need to set it as GMGN_PRIVATE_KEY in my .env)
+```
+
+**Option 2 — Binance Key Generator**
+
+Download and run the [Binance Asymmetric Key Generator](https://github.com/binance/asymmetric-key-generator/releases).
+
+Enter the **public key** in the application form.
+
+### 3.2 Get Your Public Egress IP
+
+For the IP whitelist (required when enabling swap capability on your API key):
+
+```bash
+curl ip.me
+```
+
+## 4. Configure Your API Key
+
+### Option 1: Global config (recommended)
 
 Create `~/.config/gmgn/.env` once — works from any directory:
 
@@ -67,12 +152,12 @@ mkdir -p ~/.config/gmgn
 cat > ~/.config/gmgn/.env << 'EOF'
 GMGN_API_KEY=your_api_key_here
 
-# Required for swap / order (private key from step 0):
+# Required for swap / order only:
 GMGN_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n<base64>\n-----END PRIVATE KEY-----\n"
 EOF
 ```
 
-**Option B — Project `.env`**
+### Option 2: Project `.env`
 
 ```bash
 cp .env.example .env
@@ -81,21 +166,15 @@ cp .env.example .env
 
 Config lookup order: `~/.config/gmgn/.env` → project `.env` (project takes precedence).
 
-### 3. CLI Install
+## 5. Try in AI Clients
 
-```bash
-npm install -g gmgn-cli
-```
+#### OpenClaw
 
-Local development:
+Send the following prompt directly to test the query capabilities:
 
-```bash
-npm install
-npm run build
-node dist/index.js <command> [options]
 ```
-
-### 4. Connect to Your AI Tool
+Show me the trending tokens on Solana in the last 1 hour.
+```
 
 #### Claude Code
 
@@ -105,19 +184,17 @@ Skills are automatically discovered when the package is installed as a plugin.
 
 Skills are automatically discovered via the `.cursor-plugin/` configuration.
 
-1. Complete steps 1–3 above
-2. Configure credentials in `~/.config/gmgn/.env`
-3. Restart Cursor — skills will be available in Agent mode via `/gmgn-*` commands
+1. Complete the installation and configuration steps above
+2. Restart Cursor — skills will be available in Agent mode via `/gmgn-*` commands
 
 #### Cline
 
-1. Complete steps 1–3 above
+1. Complete the installation and configuration steps above
 2. In Cline settings → **Skills directory**: point to the installed package's `skills/` folder:
    ```bash
    echo "$(npm root -g)/gmgn-skills/skills"
    ```
-3. Configure credentials in `~/.config/gmgn/.env`
-4. Restart Cline — `/gmgn-token`, `/gmgn-market`, `/gmgn-portfolio`, `/gmgn-swap` will be available
+3. Restart Cline — `/gmgn-token`, `/gmgn-market`, `/gmgn-portfolio`, `/gmgn-swap` will be available
 
 #### Codex CLI
 
@@ -141,7 +218,24 @@ See [.opencode/INSTALL.md](.opencode/INSTALL.md) for full instructions.
 
 ---
 
-## Typical Workflows
+## 6. Usage
+
+### Examples
+
+Natural language prompts you can send to any AI assistant with gmgn-cli skills installed:
+
+```
+buy 0.1 SOL of <token_address>
+sell 50% of <token_address> on BSC
+check order status <order_id>
+is <token_address> safe to buy on solana?
+show top holders of <token_address>
+show my wallet holdings on SOL
+query token details for 0x1234...
+show trading stats for wallet <wallet_address> on BSC
+```
+
+### Typical Workflows
 
 **Research a token:**
 ```
@@ -160,14 +254,14 @@ token info (confirm token)  →  portfolio token-balance (check funds)  →  swa
 
 **Discover trading opportunities via trending:**
 ```
-market trending (top 50, score-ranked)  →  AI selects top 5 by multi-factor analysis  →  user reviews  →  token info / token security  →  swap
+market trending (top 50)  →  AI selects top 5 by multi-factor analysis  →  user reviews  →  token info / token security  →  swap
 ```
 
 ---
 
-## CLI Reference
+## 7. CLI Reference
 
-Full parameter reference: [docs/cli-usage.md](docs/cli-usage.md)
+Full parameter reference: [docs/cli-usage.md](docs/cli-usage.md). All commands support `--raw` for single-line JSON output (pipe-friendly, e.g. `| jq '.price'`).
 
 ### Token
 
@@ -181,7 +275,7 @@ npx gmgn-cli token info --chain sol --address <addr>
 npx gmgn-cli market trending \
   --chain sol \
   --interval 1h \
-  --orderby volume --limit 20 \
+  --order-by volume --limit 20 \
   --filter not_risk --filter not_honeypot
 ```
 
@@ -207,9 +301,7 @@ npx gmgn-cli swap \
 npx gmgn-cli order get --chain sol --order-id <order-id>
 ```
 
----
-
-## Supported Chains
+## 8. Supported Chains
 
 | Commands | Chains | Chain Currencies |
 |----------|--------|-----------------|
@@ -218,19 +310,24 @@ npx gmgn-cli order get --chain sol --order-id <order-id>
 
 ---
 
-## Output Format
+## 9. Security & Disclaimer
 
-Default: formatted JSON. Use `--raw` for single-line JSON (pipe-friendly):
+**About `GMGN_PRIVATE_KEY`**
 
-```bash
-npx gmgn-cli token info --chain sol --address <addr> --raw | jq '.price'
-```
+`GMGN_PRIVATE_KEY` is a **request-signing key** used to authenticate API calls to the GMGN OpenAPI service. It is not a blockchain wallet private key and does not directly control on-chain assets. If compromised, an attacker could forge authenticated API requests on your behalf — rotate it immediately via the GMGN dashboard if you suspect exposure.
 
----
+**Best practices**
+
+- Restrict config file permissions: `chmod 600 ~/.config/gmgn/.env`
+- Never commit your `.env` file to version control — add it to `.gitignore`
+- Do not share `GMGN_API_KEY` or `GMGN_PRIVATE_KEY` in logs, screenshots, or chat messages
+- Use a pinned install (`npm install -g gmgn-cli@1.0.2`) rather than `npx gmgn-cli` to avoid executing unintended package updates alongside your credentials
 
-## Security & Disclaimer
+**Disclaimer**
 
-- Never commit your `.env` file or private key to version control — add them to `.gitignore`
-- Keep your `GMGN_API_KEY` and private key confidential; do not share them in logs, screenshots, or chat messages
-- The private key used for swap/order must correspond to the wallet bound to your API Key
-- **Use of this tool and any financial decisions made based on its output are entirely at your own risk. GMGN is not liable for any trading losses, errors, or unauthorized access resulting from improper credential management.**
+Use of this tool and any financial decisions made based on its output are entirely at your own risk. GMGN is not liable for any trading losses, errors, or unauthorized access resulting from improper credential management.
+
+The npm package is published with provenance attestation, linking each release to a specific git commit and CI pipeline run. Verify with:
+```bash
+npm audit signatures gmgn-cli
+```

package/Readme.zh.md

@@ -1,8 +1,16 @@
-# gmgn-cli
+<div align="center">
 
-> English: [Readme.md](Readme.md)
+<img src="static/gmgnagentskills.png" alt="GMGN Agent Skills" />
 
-GMGN 链上操作 AI 技能套件 — Token 研究、行情数据、钱包分析和交易。
+[![X](https://img.shields.io/badge/关注-%40gmgnai-black?logo=x&logoColor=white)](https://x.com/gmgnai) [![Telegram](https://img.shields.io/badge/Telegram-gmgnagentapi-2CA5E0?logo=telegram&logoColor=white)](https://t.me/gmgnagentapi) [![Discord](https://img.shields.io/badge/Discord-gmgnai-5865F2?logo=discord&logoColor=white)](https://discord.gg/gmgnai)
+
+[English](Readme.md) | 简体中文
+
+</div>
+
+## GMGN Agent Skills
+
+使用 GMGN Agent Skills，你可以通过 AI Agent 实时查询多个链上热门代币排行榜，代币基础信息，社交媒体信息，实时交易动态，实时战壕新币，报持仓大户（Top Holder），交易大户（Top Trader），聪明钱持仓占比，KOL持仓占比，老鼠仓持仓，捆绑持仓占比，等代币专业数据分析数据，以及支持代币市价单交易、限价单交易、高级止盈止损策略单交易，以及钱包资产管理相关功能，例如查询钱包实时持仓、钱包最近盈亏、钱包交易动态等，全部通过自然语言与 AI Agent 交互即可完成。
 
 ---
 
@@ -15,50 +23,127 @@ GMGN 链上操作 AI 技能套件 — Token 研究、行情数据、钱包分析
 | [`/gmgn-portfolio`](skills/gmgn-portfolio/SKILL.md) | 钱包持仓、活动、统计 | [SKILL.md](skills/gmgn-portfolio/SKILL.md) |
 | [`/gmgn-swap`](skills/gmgn-swap/SKILL.md) | 兑换提交 + 订单查询 | [SKILL.md](skills/gmgn-swap/SKILL.md) |
 
+> 如需查看详细的 CLI 接口说明、传参格式和推荐值，请参阅 [Wiki 文档](https://github.com/GMGNAI/gmgn-skills/wiki/Home-Chinese)。
+
+### 快速开始安装
+
+已准备好？[点击这里开始安装 Skills →](#开始安装-skills)
+
 ---
 
-## 用法示例
+## 使用案例
 
-安装技能后，向 AI 助手直接发送自然语言指令：
+### 查询热门代币榜
+
+发送下面提示词给 AI Agent：
+
+```
+查 Solana 1h 热门榜，筛出 6 小时内创建的新币，并且platforms是pump.fun的代币，然后按交易量从高到低排列。
+```
+
+![查询热门代币榜](static/market-rank-1h-Pumpfun-cn.png)
+
+### 实时分析代币交易走势
+
+发送下面提示词给 AI Agent：
 
 ```
-buy 0.1 SOL of <token_address>
-sell 50% of <token_address> on BSC
-check order status <order_id>
-is <token_address> safe to buy on solana?
-show top holders of <token_address>
-show my wallet holdings on SOL
-query token details for 0x1234...
-show trading stats for wallet <wallet_address> on BSC
+查看第一个代币的 K 线，分析入场时机，并提供社交媒体链接以及聪明资金 / KOL 的交易分析。
 ```
 
+![代币分析 1](static/market-tokenanalysis-cn01.png)
+![代币分析 2](static/market-tokenanalysis-cn02.png)
+
 ---
 
-## 安装配置
+## 开始安装 Skills
+
+安装前，请先在 **https://gmgn.ai/ai** 创建 API Key，用于：
 
-### 0. 准备工作
+1. 读取数据：代币、榜单、K 线、特色数据指标
+2. 提交交易：市价立即交易、创建限价单、策略单等
 
-申请 API Key 前，需要先准备两件事：
+---
 
-**生成 Ed25519 密钥对**
+## 1. 安装
 
-下载并运行 [Binance Asymmetric Key Generator](https://github.com/binance/asymmetric-key-generator/releases)。申请 API Key 时需要填入**公钥**，**私钥**稍后配置到 `.env`（swap / order 接口使用）。
+选择以下任意一种方式：
 
-**获取本机出口 IP**（用于填写 IP 白名单）
+### 1.1 通过 Agent 安装（推荐）
+
+发送给你的 AI Agent：
 
 ```bash
-curl ip.me
+npx skills add GMGNAI/gmgn-skills
+```
+
+### 1.2 npm 全局安装
+
+```bash
+npm install -g gmgn-cli@1.0.2
+```
+
+### 1.3 本地开发
+
+```bash
+npm install
+npm run build
+node dist/index.js <command> [options]
+```
+
+## 2. 验证连通性
+
+### 方式一：通过 AI Agent 验证
+
+发送以下提示词给你的 AI Agent：
+
+```
+执行这个cli命令：GMGN_API_KEY=gmgn_solbscbaseethmonadtron npx gmgn-cli market trending --chain sol --interval 1h --limit 3
+```
+
+### 方式二：通过 CLI 验证
+
+使用公共 API Key 测试，无需注册：
+
+```bash
+GMGN_API_KEY=gmgn_solbscbaseethmonadtron npx gmgn-cli market trending --chain sol --interval 1h --limit 3
+```
+
+看到 JSON 输出即表示 CLI 正常工作。公共 Key 支持所有只读接口（token / market / portfolio），公共 Key 仅用于测试，正式使用任何接口均需申请个人 API Key（见第 3 步）。
+
+## 3. 申请个人 API Key
+
+第 2 步的公共 Key 仅用于测试。正式使用（只读接口和 swap）均需在 https://gmgn.ai/ai 申请个人 API Key，需要准备：
+
+### 3.1 生成 Ed25519 密钥对
+
+**方式一：输入提示词（推荐）**
+
+将以下提示词发送给你的 AI Agent：
+
+```
+帮我用 OpenSSL 生成一个 Ed25519 密钥对，并分别显示给我：
+1. 公钥（我需要填写到GMGN网站上的 API Key 创建表单中）
+2. PEM 格式的私钥（我需要将它设置为 .env 中的 GMGN_PRIVATE_KEY）
 ```
 
-或在浏览器访问 **https://ip.me**。
+**方式二：Binance Key Generator**
+
+下载并运行 [Binance Asymmetric Key Generator](https://github.com/binance/asymmetric-key-generator/releases)。
+
+申请时填入**公钥**。
+
+### 3.2 获取本机出口 IP
 
-### 1. 获取 API Key
+用于填写 IP 白名单（开通 API Key 的交易能力时需要）：
 
-申请地址：**https://gmgn.ai/ai** — 填入上一步准备好的公钥和 IP 地址。
+```bash
+curl ip.me
+```
 
-### 2. 配置
+## 4. 配置个人 API Key
 
-**方式 A — 全局配置（推荐）**
+### 方式一：全局配置（推荐）
 
 创建 `~/.config/gmgn/.env`，配置一次，所有目录均生效：
 
@@ -67,12 +152,12 @@ mkdir -p ~/.config/gmgn
 cat > ~/.config/gmgn/.env << 'EOF'
 GMGN_API_KEY=your_api_key_here
 
-# swap / order 接口额外需要（第 0 步生成的私钥）：
+# 仅 swap / order 接口需要：
 GMGN_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n<base64>\n-----END PRIVATE KEY-----\n"
 EOF
 ```
 
-**方式 B — 项目 `.env`**
+### 方式二：项目 `.env`
 
 ```bash
 cp .env.example .env
@@ -81,21 +166,15 @@ cp .env.example .env
 
 配置加载顺序：`~/.config/gmgn/.env` → 项目 `.env`（项目级优先）。
 
-### 3. CLI 安装
+## 5. 在 AI 客户端中使用
 
-```bash
-npm install -g gmgn-cli
-```
+#### OpenClaw
 
-本地开发：
+直接发送以下提示词，测试查询能力：
 
-```bash
-npm install
-npm run build
-node dist/index.js <command> [options]
 ```
-
-### 4. 接入 AI 工具
+查询 Solana 链 1 小时热门代币
+```
 
 #### Claude Code
 
@@ -105,19 +184,17 @@ node dist/index.js <command> [options]
 
 技能通过 `.cursor-plugin/` 配置自动发现。
 
-1. 完成上方步骤 1–3
-2. 配置凭证：`~/.config/gmgn/.env`
-3. 重启 Cursor — Agent 模式下可通过 `/gmgn-*` 命令使用技能
+1. 完成上方安装和配置步骤
+2. 重启 Cursor — Agent 模式下可通过 `/gmgn-*` 命令使用技能
 
 #### Cline
 
-1. 完成上方步骤 1–3
+1. 完成上方安装和配置步骤
 2. 在 Cline 设置 → **Skills directory**：填入已安装包的 `skills/` 目录路径：
    ```bash
    echo "$(npm root -g)/gmgn-skills/skills"
    ```
-3. 配置凭证：`~/.config/gmgn/.env`
-4. 重启 Cline — `/gmgn-token`、`/gmgn-market`、`/gmgn-portfolio`、`/gmgn-swap` 即可使用
+3. 重启 Cline — `/gmgn-token`、`/gmgn-market`、`/gmgn-portfolio`、`/gmgn-swap` 即可使用
 
 #### Codex CLI
 
@@ -141,33 +218,50 @@ ln -s ~/.opencode/gmgn-cli/skills ~/.agents/skills/gmgn-cli
 
 ---
 
-## 典型使用场景
+## 6. 使用示例
+
+### 常用指令
+
+安装技能后，向 AI 助手直接发送自然语言指令：
+
+```
+用 0.1 SOL 买入 <token_address>
+卖出 BSC 上 <token_address> 的 50%
+查询订单状态 <order_id>
+solana 上的 <token_address> 安全吗，值得买入吗？
+查看 <token_address> 的前十大持有者
+查看我在 SOL 上的钱包持仓
+查询 0x1234... 的代币详情
+查看 BSC 上钱包 <wallet_address> 的交易统计
+```
+
+### 典型使用场景
 
 **研究 Token：**
 ```
-token info  →  token security  →  token pool  →  token holders
+查询代币信息  →  查询安全指标  →  查询流动池  →  查询持有者
 ```
 
 **分析钱包：**
 ```
-portfolio holdings  →  portfolio stats  →  portfolio activity
+查询钱包持仓  →  查询交易统计  →  查询交易记录
 ```
 
 **执行交易：**
 ```
-token info（确认 Token）  →  portfolio token-balance（检查余额）  →  swap  →  order get（轮询状态）
+确认代币信息  →  检查余额  →  提交兑换  →  轮询订单状态
 ```
 
-**通过 Trending 发现交易机会：**
+**通过热门榜单发现交易机会：**
 ```
-market trending（取 50 条，按 score 排序）  →  AI 多维度分析选出 top 5  →  用户确认  →  token info / token security  →  swap
+获取热门代币（50 条）  →  AI 多维度分析选出 top 5  →  用户确认  →  查询代币信息 / 安全指标  →  提交兑换
 ```
 
 ---
 
-## CLI 参考
+## 7. CLI 参考
 
-完整参数说明：[docs/cli-usage.md](docs/cli-usage.md)
+完整参数说明：[docs/cli-usage.md](docs/cli-usage.md)。所有命令均支持 `--raw` 输出单行 JSON（方便 `jq` 等工具处理）。
 
 ### Token
 
@@ -181,7 +275,7 @@ npx gmgn-cli token info --chain sol --address <addr>
 npx gmgn-cli market trending \
   --chain sol \
   --interval 1h \
-  --orderby volume --limit 20 \
+  --order-by volume --limit 20 \
   --filter not_risk --filter not_honeypot
 ```
 
@@ -207,9 +301,7 @@ npx gmgn-cli swap \
 npx gmgn-cli order get --chain sol --order-id <order-id>
 ```
 
----
-
-## 支持的链
+## 8. 支持的链
 
 | 接口类型 | 支持的链 | 链原生货币 |
 |----------|----------|-----------|
@@ -218,19 +310,19 @@ npx gmgn-cli order get --chain sol --order-id <order-id>
 
 ---
 
-## 输出格式
+## 9. 安全与免责
 
-默认输出格式化 JSON。使用 `--raw` 输出单行 JSON（方便 jq 等工具处理）：
+**关于 `GMGN_PRIVATE_KEY`**
 
-```bash
-npx gmgn-cli token info --chain sol --address <addr> --raw | jq '.price'
-```
+`GMGN_PRIVATE_KEY` 是用于对 GMGN OpenAPI 请求进行签名认证的**签名密钥**，不是区块链钱包私钥，不直接控制链上资产。若泄露，攻击者可以伪造经过认证的 API 请求——请立即通过 GMGN 控制台轮换密钥。
 
----
+**最佳实践**
+
+- 限制配置文件权限：`chmod 600 ~/.config/gmgn/.env`
+- 不要将 `.env` 文件提交到版本控制系统，请将其加入 `.gitignore`
+- 不要在日志、截图或聊天中泄露 `GMGN_API_KEY` 或 `GMGN_PRIVATE_KEY`
+- 使用固定版本安装（`npm install -g gmgn-cli@1.0.2`），而非 `npx gmgn-cli`，以避免在持有凭证的环境中执行未预期的包更新
 
-## 安全与免责
+**免责声明**
 
-- 不要将 `.env` 文件或私钥提交到版本控制系统，请将其加入 `.gitignore`
-- 请妥善保管 `GMGN_API_KEY` 和私钥，不要在日志、截图或聊天中泄露
-- swap/order 使用的私钥必须与绑定该 API Key 的钱包一致
-- **使用本工具及根据其输出做出的任何财务决策，风险由用户自行承担。GMGN 对因凭证管理不当导致的任何交易损失、错误或未授权访问不承担责任。**
+使用本工具及根据其输出做出的任何财务决策，风险由用户自行承担。GMGN 对因凭证管理不当导致的任何交易损失、错误或未授权访问不承担责任。