gate-exchange-assetswap

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's setup.sh fetches and installs a remote gate-cli binary at runtime from GitHub (calls to https://api.github.com/repos/gate/gate-cli/releases/latest and https://github.com/gate/gate-cli/releases/download/.../), which downloads and executes remote code and is a required dependency for the skill.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provides encoded tooling and workflows to execute trades on Gate Exchange: it requires API keys (GATE_API_KEY / GATE_API_SECRET), demands Trade permissions, and lists write/execute commands including gate-cli cex assetswap order preview and gate-cli cex assetswap order create. Those commands perform previewed transaction creation (asset swaps/rebalances) — i.e., direct execution of financial transactions on an exchange. This is a specific financial execution capability (crypto/exchange order placement), not a generic tool, so it meets the "Direct Financial Execution" criterion.