The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The setup.sh script included in the skill contains logic to use sudo install to place the gate-cli binary in /usr/local/bin if it cannot be installed in the user's local directory. While this is a common pattern for CLI tool installation, it involves acquiring elevated permissions.
[EXTERNAL_DOWNLOADS]: The skill downloads the gate-cli binary and its associated checksum files from the official Gate repository on GitHub (github.com/gate/gate-cli). This occurs during the skill's setup process via the setup.sh script and is also defined in the skill's metadata for platform-specific installation.
[COMMAND_EXECUTION]: The skill's primary functionality relies on executing gate-cli commands for both read-only queries (activities, rules, progress) and state-changing actions (registration). The skill correctly implements a mandatory "Preview-Confirm" workflow for the register command to ensure user intent before execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from the Gate API, creating a surface for potential indirect prompt injection through activity details and task descriptions.
Ingestion points: The skill reads output from gate-cli which contains data from external exchange servers (referenced in SKILL.md and references/activities.md).
Boundary markers: The skill includes explicit instructions for the agent to present a preview and wait for user confirmation ("confirm"/"cancel") before performing write operations.
Capability inventory: The skill has the ability to execute shell commands, perform network requests (via the CLI), and write to the file system during installation.
Sanitization: The skill employs structured response templates and a specific mapping table for task types (rule_name) to normalize API data before it is presented to the user.

gate-exchange-candydrop