gate-exchange-simpleearn
Warn
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the gate-cli binary from the official vendor repository on GitHub (github.com/gate/gate-cli) during the installation process.
- [PRIVILEGE_ESCALATION]: The included setup.sh script contains a fallback mechanism that attempts to use sudo to install the gate-cli binary into the system directory /usr/local/bin if the user's local binary directory is not writable.
- [INDIRECT_PROMPT_INJECTION]: The skill accepts and processes untrusted user-supplied data such as currency names, transaction amounts, and order identifiers for financial operations. It mitigates potential injection risks by requiring explicit user confirmation for all state-changing actions and presenting pre-execution 'Action Drafts' for review.
Audit Metadata