gate-exchange-launchpool

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's setup.sh downloads and installs the gate-cli binary at runtime from GitHub (e.g. https://api.github.com/repos/gate/gate-cli/releases/latest and https://github.com/gate/gate-cli/releases/download/{VERSION}/{ARCHIVE}), which fetches and executes remote code as a required dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly exposes write operations for moving funds on an exchange: it documents and requires use of gate-cli cex launch pledge (stake/pledge) and gate-cli cex launch redeem (unstake/redeem). It also details authentication with API keys, permissions (Launch:Write), and a full execution workflow (preview then confirm) for creating transactions. These are specific crypto financial operations (staking/airdrop participation) — not generic tooling — and therefore constitute Direct Financial Execution authority.