Gate Spot Exchange Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:55 AM UTC
• Version: 1.0.1

Overview

The skill is a real Gate spot-trading helper, but its instructions are inconsistent about when real order cancellations and amendments require confirmation.

Review carefully before installing. This skill needs Gate API credentials with spot write access and can place, amend, or cancel real spot orders. The package does include strong confirmation rules in some files, but they are inconsistent for cancellation and amendment flows, especially cancel-all, so only use it if you are comfortable enforcing manual confirmation for every write action and limiting API key permissions to the minimum needed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:163

Finding

Inconsistent Confirmation Gates Permit Financial Write Operations Without Explicit Approval

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (16)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

- `SKILL.md` remains the intent routing and scenario map.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill contains directly contradictory safety guidance: it says TP/SL is not supported while earlier sections define and route TP/SL trigger-order workflows. In a trading skill with write permissions, this inconsistency can cause the agent to mis-handle user requests, either refusing supported protective orders or, worse, applying the wrong execution path for risk-sensitive trades.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are broad and include generic terms like 'buy', 'sell', 'rebalance', and 'cancel order', which can cause the skill to activate in ambiguous contexts. Because this skill can perform real spot trading and order-management actions, accidental invocation could lead to unintended financial transactions or account changes, especially if activation occurs before the user clearly intended to use this specific skill.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

## General Rules

⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding.
Do NOT select or call any tool until all rules are read. These rules have the highest priority.
→ Read `./references/gate-runtime-rules.md`
- **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they
  exist in the MCP server.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

- Credentials Source: Local Gate MCP deployment (`GATE_API_KEY`, `GATE_API_SECRET`)
- API Key Required: Yes
- Permissions: Spot:Write, Wallet:Read
- Never ask the user to paste secrets into chat; rely on the configured MCP session only.
- API Key Provisioning Reference: https://www.gate.com/myaccount/profile/api-key/manage (create or rotate keys outside the chat when the local MCP setup requires them).

### Installation Check

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

1. Send order draft (no trading call yet)
2. Wait for explicit user approval
3. Only after approval, submit the real order
4. Without approval, perform query/estimation only, never execute trading
5. Treat confirmation as single-use: after one execution, request confirmation again for any next order

Required confirmation fields:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The example response templates are written only in Chinese-language text snippets, which can imply a default enforced output language regardless of the user's preferred language. The file does not state that language should follow the user's preference or that these are merely optional localized examples.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/gate-runtime-rules.md (reported line 16)May include surrounding context.

md

## 1. MCP Session and Authentication

- Use the already configured Gate MCP session for the current host.
- Local Gate MCP deployments use `GATE_API_KEY` and `GATE_API_SECRET`; never ask the user to paste these secrets into chat.
- Minimal permissions for this skill are `Spot:Write` and `Wallet:Read`.
- If the required Gate MCP tools are missing, stop write actions and switch to setup guidance only.
- If the MCP session returns an auth or permission error, stop write actions and guide the user to repair the configured local MCP credentials before continuing.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/scenarios.md (reported line 43)May include surrounding context.

md

3. Output `Limit Order Draft` and then `Open Order/Execution Report` after confirmation.
   **Unexpected Behavior**:
1. Converts to market order and executes immediately even though user asked for limit price.
2. Returns "open order created" without checking whether quote balance can support order value.
3. Uses wrong price precision and returns exchange error without a user-readable fix suggestion.

## Scenario 3: Buy with All USDT

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/scenarios.md (reported line 274)May include surrounding context.

md

3. Output `Limit Order Draft` and then `Open Order/Execution Report` after confirmation.
   **Unexpected Behavior**:
1. Converts to market order and executes immediately even though user asked for limit price.
2. Returns "open order created" without checking whether quote balance can support order value.
3. Uses wrong price precision and returns exchange error without a user-readable fix suggestion.

## Scenario 3: Buy with All USDT

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/scenarios.md (reported line 181)May include surrounding context.

md

3. Output `Downside-Exit Draft` and then `Execution/Open-Order Report` after confirmation.
   **Unexpected Behavior**:
1. Claims native TP/SL trigger support and submits unsupported order semantics.
2. Executes sell without confirmation under "risk-control urgency" wording.
3. Computes 5% drop from wrong anchor (entry price vs current price) without disclosure.

## Scenario 13: Buy Top 24h Gainer

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown includes a Chinese prompt example as normative scenario content, but the document does not state that language use is optional or user-selected. Under the language/locale policy, forcing or assuming a specific language without opt-in can be a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The scenario provides a Chinese-language prompt example without accompanying guidance that language selection follows user preference. That can imply a locale-specific interaction mode without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

A Chinese-only example appears in the scenario set, but there is no explicit statement that the skill should honor the user's preferred language. This may violate the language/locale policy if interpreted as a required interaction language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file includes Chinese-language scenario text without any opt-in or locale-selection guidance. That creates an avoidable ambiguity around whether the skill assumes a fixed language or locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This scenario includes a Chinese prompt example but does not clarify that language choice is user-driven. Without that clarification, the document can be read as prescribing a specific language behavior.

Content

No source excerpt is available for this finding.