gate-exchange-newcoin
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from external sources, including exchange announcements, news feeds, and social sentiment analysis (found in SKILL.md and references/gate-cli.md). This external content is used to inform research reports and trading decisions. Although the skill mandates an Action Draft and explicit user confirmation ('Y/N') before executing any trade, it lacks explicit data delimiters or instructions to ignore embedded commands in the processed external text, creating a vulnerability surface.
- [EXTERNAL_DOWNLOADS]: The setup.sh script and SKILL.md installation metadata download the gate-cli binary from github.com/gate/gate-cli. This is a vendor-owned resource hosted on GitHub, consistent with the skill's stated authorship and intended purpose.
- [COMMAND_EXECUTION]: The skill is designed to execute shell commands via the gate-cli tool to query market data, retrieve news, and perform spot or alpha order operations on the Gate.io exchange.
Audit Metadata