gate-exchange-options
Pass
Audited by Gen Agent Trust Hub on Apr 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the gate-cli binary directly from the official Gate GitHub repository (github.com/gate/gate-cli) during the installation process, utilizing checksums for integrity verification.
- [COMMAND_EXECUTION]: The setup script executes installation commands to move the binary into the execution path, attempting to install in the user's home directory to avoid needing elevated privileges.
- [COMMAND_EXECUTION]: If local installation is unsuccessful, the setup script uses sudo to install the binary to /usr/local/bin.
- [COMMAND_EXECUTION]: The skill performs exchange operations by executing the gate-cli binary with parameters derived from user instructions, such as contract name, size, and price.
- [PROMPT_INJECTION]: The skill ingests user input to formulate financial orders, representing an indirect prompt injection surface. This is mitigated by providing a detailed order summary and requiring an explicit 'confirm' response before any tools that mutate state are invoked.
Audit Metadata