gate-news-listing

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:34 PM UTC
• Version:
  1.0.1

Overview

This skill is a read-only exchange listing news helper with disclosed data tools and no evidence of hidden installation, credential use, persistence, or destructive behavior.

Reasonable to install if you want exchange listing and delisting reports. Verify important trading decisions against primary exchange announcements, and ensure the Gate News/Gate Info MCP tools you enable are trusted because the skill depends on their returned public market data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Scope Creep

Medium

• Confidence: 94% confidence
• Finding: The manifest declares no required permissions while the skill explicitly authorizes several MCP tool calls. This creates a permission-model mismatch that can mislead reviewers or enforcement layers about the skill's actual capabilities, weakening governance and auditability even if the tools are read-only.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger phrases are broad, natural-language queries that many users could say in adjacent contexts, increasing the chance this skill activates when a different exchange-news or market-summary behavior was intended. In an agent setting, overbroad activation can misroute user requests, cause unnecessary tool calls, and present incomplete or misleading exchange-listing information as if it were the best-fit response.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The specific-exchange examples are still underspecified because short prompts like 'What did Binance list' can overlap with requests for historical listings, a single asset, or broader exchange analysis. Without clearer activation boundaries, the agent may invoke this skill in cases where the user wanted a different timeframe, exchange comparison, or non-announcement information, leading to incorrect or partial answers.

VirusTotal

66/66 vendors flagged this skill as clean.