gate-exchange-coupon
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the official
gate-clibinary and checksums from the Gate GitHub repository to enable coupon query functionality. Thesetup.shscript also downloads release metadata from the GitHub API to resolve the latest version. - [COMMAND_EXECUTION]: Executes the
gate-clitool for account-specific queries, such as listing coupons and fetching details. Additionally, it invokespython3to convert Unix timestamps into human-readable UTC strings for display. - [PRIVILEGE_ESCALATION]: The
setup.shinstallation script may utilizesudo installas a fallback to move the CLI binary into/usr/local/binif the local user directory is not writable. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and displays external data (coupon names, sources, and usage rules) returned by the Gate Exchange API, which could potentially contain adversarial instructions designed to influence the agent.
- Ingestion points: Data returned from
gate-cli cex coupon listandgate-cli cex coupon detailas processed in thereferences/modules. - Boundary markers: None identified for prompt interpolation.
- Capability inventory: Read-only
gate-clioperations and local Python-based timestamp formatting. - Sanitization: Implements status code mapping and specific formatting logic for different data types to ensure consistent rendering.
Audit Metadata