Gate Exchange Coupon

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:12 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a read-only Gate coupon viewer, but it includes unsafe timestamp-conversion instructions that can push an agent outside the declared MCP-only scope.

Install only if you trust the Gate MCP endpoint and your agent runtime will not follow the unsafe python3 timestamp-conversion examples. The skill should be revised to validate timestamps as integers and format dates without invoking local code or shell/programming tools.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/list-coupons.md:67

Finding

Command Injection Through Unvalidated Coupon Timestamp Interpolation

Content

View full analysis

Vulnerability Details

File Location: references/list-coupons.md:67-69
Vulnerability Type: Command injection through untrusted MCP response interpolation
Risk Level: Medium

Vulnerable Code

markdown

- `Expires (Remaining)`: format as `YYYY-MM-DD (UTC) ({X} days)`. Use `< 1 day` when less than 24 hours remain. Use `Expired` if already past. The `expire_time_order_by` value is a Unix timestamp (seconds since epoch) — use a programming tool to convert it to UTC date (e.g. `python3 -c "from datetime import *; print(datetime.fromtimestamp({value}, timezone.utc).strftime('%Y-%m-%d'))"`). Batch all timestamps into a single tool call to avoid repeated invocations.

Technical Analysis

The workflow directs the Agent to interpolate the MCP-provided expire_time_order_by value directly into Python source passed to python3 -c. No requirement validates that the value is a bounded integer before interpolation.

If the Gate MCP server, its transport, or the upstream response is compromised, an attacker-controlled value can be interpreted as a Python expression rather than timestamp data. For example, a value shaped like __import__('os').system('ATTACKER_COMMAND') or 0 would execute the supplied operating-system command when inserted into datetime.fromtimestamp({value}, ...).

The instruction also conflicts with the tool restrictions in SKILL.md:33-34 and references/gate-runtime-rules.md:22-23, which limit the Skill to documented Gate MCP tools and prohibit unrelated system tools. Encouraging a programming tool unnecessarily expands the execution surface beyond the minimum privileges required to display a date.

Attack Path

1. An attacker compromises or impersonates the Gate MCP service, modifies its response, or otherwise gains influence over expire_time_order_by.
2. The service returns a malicious Python expression in place of a numeric Unix timestamp.
3. The Agent follows the documented workfl ...[truncated 864 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the instruction to invoke python3, a shell, or another general-purpose programming tool for timestamp conversion.
• Use a trusted, non-executable runtime date-formatting operation that treats the timestamp strictly as data.
• Validate expire_time_order_by before conversion:
  • Require an integer-only value.
  • Reject strings, expressions, and unexpected types.
  • Enforce a reasonable Unix timestamp range.
• If an external conversion tool is unavoidable, pass the timestamp through a typed argument or standard input rather than interpolating it into source code.
• Keep the workflow within the two documented Gate MCP tools and the platform's built-in formatting capabilities.
• Add explicit handling for invalid timestamps and return an unavailable or malformed-data indicator rather than attempting execution.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/coupon-detail.md:47

Finding

Command Injection Through Unvalidated Detail and Task Timestamp Conversion

Content

View full analysis

Vulnerability Details

File Location: references/coupon-detail.md:47-50, 66-74
Vulnerability Type: Command injection through untrusted MCP response interpolation
Risk Level: Medium

Vulnerable Code

markdown

### Formatting Rules for `extra` item types

- `timestamp` → `YYYY-MM-DD HH:mm` in **UTC**. The value is a Unix timestamp (seconds since epoch). Use a programming tool to convert it (e.g. `python3 -c "from datetime import *; print(datetime.fromtimestamp({value}, timezone.utc).strftime('%Y-%m-%d %H:%M'))"`). Append ` (UTC)` suffix to the result.
- `day` → `{N} day(s)`
- `hour` → `{N} hour(s)`
- `status` → human-readable text from Status Text Mapping above (no emoji prefix)
- `string` → display as-is
- `btn` → display the value as plain text (button label); do not render as a link or interactive element

markdown

### Task Coupon Extra Time Fields

For task coupons (`is_task_coupon=1`), additionally append the following top-level fields to the **Time Info** section if their value is non-zero:

| Field | Display Label | Format |
|-------|--------------|--------|
| `task_start_at` | Task Start Time | `YYYY-MM-DD HH:mm (UTC)` |
| `task_expire_at` | Task Expires At | `YYYY-MM-DD HH:mm (UTC)` |
| `task_completed_at` | Task Completed At | `YYYY-MM-DD HH:mm (UTC)` |

All three are Unix timestamps (seconds, UTC+0). Skip any field whose value is `0`. Convert using a programming tool, same as other timestamp fields.

Technical Analysis

Coupon detail timestamps from the MCP response are treated as values to be inserted into executable Python source. The workflow does not require type checking, integer parsing, range validation, or separation between code and data.

A malicious value supplied in an extra timestamp item, task_start_at, task_expire_at, or task_completed_at can therefore become a Python expression when substituted for {value}. Python evaluates that expression ...[truncated 1738 chars]

Remediation

View remediation

Remediation Suggestions

• Eliminate all instructions to convert response fields by constructing executable Python or shell source.
• Parse every timestamp as a strict integer before formatting.
• Apply explicit lower and upper bounds appropriate for valid coupon dates.
• Reject booleans, strings containing non-digit characters, Python expressions, and composite objects.
• Use a built-in, non-executable UTC date formatter that does not require a system or programming tool.
• If a separate process is unavoidable, provide the validated timestamp through a typed command argument or standard input and invoke a fixed program without a shell.
• Apply the same validation consistently to extra timestamps, task_start_at, task_expire_at, and task_completed_at.
• On malformed values, omit the field or label it as invalid while surfacing the backend data-quality failure.
• Update the workflow to comply with its least-privilege policy by using only approved Gate MCP tools and safe platform-native formatting.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

- `SKILL.md` keeps coupon semantics, mapping rules, and rendering policy.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

## General Rules

⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding.
Do NOT select or call any tool until all rules are read. These rules have the highest priority.
→ Read `./references/gate-runtime-rules.md`
- **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they
  exist in the MCP server.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

- Credentials Source: Local Gate MCP deployment (`GATE_API_KEY`, `GATE_API_SECRET`)
- API Key Required: Yes
- Permissions: Coupon:Read
- Never ask the user to paste secrets into chat; rely on the configured MCP session only.
- API Key Provisioning Reference: https://www.gate.com/myaccount/profile/api-key/manage (create or rotate keys outside the chat when the local MCP setup requires them).

### Installation Check

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

> **IMPORTANT — Type Translation Rule**: When displaying the coupon type, map `coupon_type` strictly to the Display Name. You may translate Display Names to match the response language, but **the mapping must be exact** — never swap or conflate two different types. Critical distinction: `position_voucher` (Position Trial Voucher) is a **position-based trial voucher** — translate as "仓位体验券" in Chinese, never as "合约体验金"; `contract_bonus` (Futures Bonus) is **futures trial funds** — translate as "合约体验金". They are completely different products.

| `coupon_type`             | Display Name                          | Description                                                                                                           |
| ------------------------- | ------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| `position_voucher`        | Position Trial Voucher                | Virtual capital for opening futures positions (NOT the same as Futures Bonus). Profits can be withdrawn; the principal is reclaimed after expiry. |
| `tradfi_position_voucher` | TradFi Position Voucher               | Same concept as position voucher but applies to TradFi instruments (stocks, forex, etc.).                             |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md

### `cex_coupon_list_user_coupons` Parameters


| Parameter        | Default  | Description                                                                                                     |
| ---------------- | -------- | --------------------------------------------------------------------------------------------------------------- |
| `expired`        | `0`      | `0` = valid coupons; `1` = expired/used coupons                                                                 |
| `limit`          | `20`     | Page size (1–20)                                                                                                |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md

| Parameter        | Default  | Description                                                                                                     |
| ---------------- | -------- | --------------------------------------------------------------------------------------------------------------- |
| `expired`        | `0`      | `0` = valid coupons; `1` = expired/used coupons                                                                 |
| `limit`          | `20`     | Page size (1–20)                                                                                                |
| `last_id`        | `0`      | Cursor pagination: last id from previous page                                                                   |
| `expire_time`    | `0`      | Cursor pagination: `expire_time_order_by` of the last item from the previous page; used together with `last_id` |
| `order_by`       | `latest` | `latest` = by acquisition time; `expired` = by expiry asc                                                       |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md

| `last_id`        | `0`      | Cursor pagination: last id from previous page                                                                   |
| `expire_time`    | `0`      | Cursor pagination: `expire_time_order_by` of the last item from the previous page; used together with `last_id` |
| `order_by`       | `latest` | `latest` = by acquisition time; `expired` = by expiry asc                                                       |
| `coupon_type`    | (all)    | Filter by coupon type                                                                                           |
| `is_task_coupon` | (all)    | `0` = regular only; `1` = task coupons only                                                                     |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

md

Classify the user intent and route to the matching reference document:


| Intent                         | Example Phrases                                                                                                          | Route to                                                               |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------- |
| **List available coupons**     | "What coupons do I have?", "Show my available coupons", "Do I have any vouchers?", "Check my coupon balance"             | Read `references/list-coupons.md`                                      |
| **Search by coupon type**      | "Do I have a commission rebate voucher?", "Check if I have a futures bonus", "Show my VIP trial cards"                   | Read `references/list-coupons.md`                                      |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md

| **View usage rules**           | "What are the rules for this coupon?", "How do I use this voucher?", "What are the terms of my futures bonus?"           | Read `references/coupon-detail.md`                                     |
| **Trace coupon source**        | "How did I get this coupon?", "Where did this voucher come from?", "What activity gave me this coupon?"                  | Read `references/coupon-detail.md`                                     |
| **Query expired/used coupons** | "Show my used coupons", "List my expired vouchers", "What coupons have I used?"                                          | Read `references/list-coupons.md`                                      |
| **Unclear**                    | "Tell me about my coupons", "coupon help"                                                                                | Clarify: ask if user wants to list all coupons or check a specific one |


## Execution

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md

1. Identify user intent from the Routing Rules table above.
2. Load the corresponding reference document.
3. Follow the workflow in that document step by step.
4. All operations are read-only — no confirmation gate required.

## Error Handling

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md

## Error Handling


| Situation                        | Action                                                                                                                                         |
| -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| Coupon not found                 | Coupon record does not exist or does not belong to current user. Ask user to re-check which coupon they meant; re-fetch list to get valid IDs. |
| Invalid coupon type              | `coupon_type` is not a recognized enum value. Map user's natural language to the Coupon Types Reference table and retry.                       |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/gate-runtime-rules.md (reported line 16)May include surrounding context.

md

## 1. MCP Session and Authentication

- Use the already configured Gate MCP session for the current host.
- Local Gate MCP deployments use `GATE_API_KEY` and `GATE_API_SECRET`; never ask the user to paste these secrets into chat.
- Minimal permission for this skill is `Coupon:Read`.
- If the required Gate MCP tools are missing, stop and switch to setup guidance only.
- If the MCP session returns an auth or permission error, stop and guide the user to repair the configured local MCP credentials before continuing.