gate-dex-market-cli

SUSPICIOUS. The stated purpose is coherent for a market-data skill, but the installation and execution model is not proportionate: it asks the agent to download and run an unverifiable external binary from mutable URLs, with no visible checksums or release verification. Data access is mostly consistent with read-only crypto market queries, yet the opaque CLI prevents validating actual endpoints and handling. This is better classified as high supply-chain risk than confirmed malware.

The fragment is an installation/update script rather than demonstrably malicious code. It contains a significant supply-chain security weakness: it installs and executes an externally downloaded binary without checksum or signature verification and defaults to a mutable latest release. The code should use a pinned immutable artifact plus trusted signature or checksum validation before installation. No direct evidence of credential theft, exfiltration, persistence, or sabotage appears in the supplied script.