gate-dex-trade-cli

SUSPICIOUS/HIGH-RISK skill. Its purpose matches its trading behavior, but it depends on an unverifiable downloaded binary that reads local auth state and performs server-side signing for real asset transfers. The main issue is not mismatch of purpose, but disproportionate trust in a black-box executable plus backend for high-impact financial actions.

The fragment is an installation/update script rather than demonstrably malicious code. It contains a significant supply-chain security weakness: it installs and executes an externally downloaded binary without checksum or signature verification and defaults to a mutable latest release. The code should use a pinned immutable artifact plus trusted signature or checksum validation before installation. No direct evidence of credential theft, exfiltration, persistence, or sabotage appears in the supplied script.