gate-info-coincompare

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill includes maintenance scripts (update-skill.sh and update-skill.ps1) that download repository archives and perform git operations targeting the official vendor repository at github.com/gate/gate-skills. These downloads are used to synchronize the skill's files with the latest published versions.
  • [COMMAND_EXECUTION]: The agent is instructed to execute local shell scripts to perform version checks and apply updates. Additionally, the skill runs a deterministic shell probe at startup to detect the local filesystem structure and determine if requests should be routed to the gate-cli primary skill.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from market-related MCP tools and interpolates it into a comparison report.
  • Ingestion points: Untrusted data enters the agent context via MCP tools including info_coin_get_coin_info and info_marketsnapshot_get_market_snapshot.
  • Boundary markers: The report template uses clear Markdown section headers and tables to delimit data from different coins.
  • Capability inventory: The skill possesses shell execution capabilities for internal maintenance and routing probes as documented in SKILL.md.
  • Sanitization: No specific sanitization logic is implemented for the market data, as the input is expected to be structured financial metrics.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 09:04 AM