gate-dex-market

SUSPICIOUS. The core purpose and official Gate endpoints mostly align with a read-only market-data skill, but the skill unnecessarily auto-provisions built-in API credentials, reads raw secrets from a home-directory file, and relies on an unprovided helper script plus remote rule documents for execution details. These are medium-risk trust and credential-handling issues rather than confirmed malware.

The code is a readable API client with an explicit authenticated network function. It does not show clear malicious behavior, but hardcoded fallback API credentials create a significant exposure and may permit unauthorized DEX operations. Credentials should be revoked or rotated, removed from source, and loaded only from securely protected configuration or environment-managed secrets. The API action surface should also be restricted or validated where appropriate.

The material documents a market-data API integration and does not itself demonstrate malware or data exfiltration. It contains exposed hardcoded credentials and instructs automatic persistent storage of those credentials. The unspecified helper script is a significant review gap because it performs the authenticated network operation. Treat the embedded credentials as compromised, rotate them, and review the helper script before execution.