gate-info-defianalysis
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes maintenance scripts (update-skill.sh, update-skill.ps1) that fetch updates from the vendor's official GitHub repository (github.com/gate/gate-skills). These downloads are part of a documented update flow from a trusted source.
- [COMMAND_EXECUTION]: The agent is instructed to run local shell scripts for skill maintenance and a routing probe to check for environment configurations. These operations are consistent with the skill's management requirements.
- [REMOTE_CODE_EXECUTION]: The self-update mechanism downloads and installs updated versions of the skill instructions and scripts from the vendor's repository. This behavior is documented and linked to a trusted organization.
- [PRIVILEGE_ESCALATION]: The instructions for the Windows update process utilize the ExecutionPolicy Bypass flag for PowerShell, which is a common practice for executing local maintenance scripts in that environment.
- [INDIRECT_PROMPT_INJECTION]: The skill processes DeFi market data from the Gate-Info MCP server to generate reports, representing a potential ingestion point for indirect instructions, although the source is the same trusted vendor.
Audit Metadata