ClawHub

Gate Exchange Affiliate Program Skill

v1.0.0

Gate partner affiliate data and application skill. Use when the user asks about partner commissions, referral volume, or applying for the affiliate program....

⭐ 0· 44·0 current·0 all-time
bygaixg@gaixianggeng
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The skill is a Gate affiliate/partner data helper and requires GATE_API_KEY and GATE_API_SECRET — credentials that are expected and necessary to call Gate partner APIs. There are no unrelated env vars, binaries, or config paths requested that would be disproportionate to the described functionality.
✓
Instruction Scope
SKILL.md is explicit about using the local Gate MCP session, lists only read-only partner endpoints/tools, enforces time-window rules, and contains runtime guardrails (do not ask users to paste secrets, do not call undocumented tools). It does not instruct reading arbitrary files or exfiltrating data beyond the partner APIs. The instructions are narrow and consistent with the described purpose.
✓
Install Mechanism
This is an instruction-only skill with no install spec and no code files. That minimizes disk writes and reduces supply-chain risk; there are no download URLs or package installs to review.
✓
Credentials
Only two environment variables are declared (GATE_API_KEY, GATE_API_SECRET) and the primaryEnv is set correctly. The skill requests the minimal permission scope (Rebate:Read) appropriate for reading affiliate/commission data. No unrelated credentials are requested.
✓
Persistence & Privilege
The skill is not force-included (always: false) and does not request persistent system modifications. Autonomous invocation is allowed by platform default but is not combined with any other concerning privileges or broad credential access.
Assessment
Things to consider before enabling: ensure the skill comes from a trusted source (verify the GitHub homepage and owner), provide a least-privilege Gate API key scoped to Rebate:Read rather than an account-wide/admin key, confirm your environment isolates the MCP session so keys are not exposed elsewhere, do not paste keys into chat (the skill also warns against this), and rotate or revoke the API key if you stop using the skill. If you do not have a local Gate MCP deployment or you cannot supply keys securely, avoid enabling the skill.

Like a lobster shell, security has layers — review code before you run it.

latestvk970jw6rq7xhg6f6qp3ag979wx84eyn9

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

EnvGATE_API_KEY, GATE_API_SECRET
Primary envGATE_API_KEY

Comments