gate-info-coincompare
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes maintenance scripts (
update-skill.shandupdate-skill.ps1) that download repository archives and perform git operations targeting the official vendor repository atgithub.com/gate/gate-skills. These downloads are used to synchronize the skill's files with the latest published versions. - [COMMAND_EXECUTION]: The agent is instructed to execute local shell scripts to perform version checks and apply updates. Additionally, the skill runs a deterministic shell probe at startup to detect the local filesystem structure and determine if requests should be routed to the
gate-cliprimary skill. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from market-related MCP tools and interpolates it into a comparison report.
- Ingestion points: Untrusted data enters the agent context via MCP tools including
info_coin_get_coin_infoandinfo_marketsnapshot_get_market_snapshot. - Boundary markers: The report template uses clear Markdown section headers and tables to delimit data from different coins.
- Capability inventory: The skill possesses shell execution capabilities for internal maintenance and routing probes as documented in
SKILL.md. - Sanitization: No specific sanitization logic is implemented for the market data, as the input is expected to be structured financial metrics.
Audit Metadata