Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `SKILL.md` keeps user-type routing, task-display semantics, and policy constraints.
Security audit
gate-exchange-welfare
Security checks for vulnerabilities and agentic risk
Overview
This skill is a read-only Gate welfare lookup that uses disclosed Gate MCP credentials to check eligibility and show task information.
Install only if you intend to let the Gate MCP session read your welfare eligibility and new-user task status. The skill should not trade, claim rewards, or change account data, but ambiguous reward or task questions may still trigger a welfare eligibility check.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (18)
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
Expected Behavior:
- Call
cex_welfare_get_user_identity(user type determination interface), return result: code=1008 (not logged in). - Output prompt text:
text Please log in to your Gate account first before querying welfare tasks.- Call
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
Expected Behavior:
- Call
cex_welfare_get_user_identity(user type determination interface), return result: code=1008 (not logged in). - Output prompt text:
text Please log in to your Gate account first before querying welfare tasks.- Call
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
Expected Behavior:
- Call
cex_welfare_get_user_identity(user type determination interface), return result: code=1008 (not logged in). - Output prompt text:
text Please log in to your Gate account first before querying welfare tasks.- Call
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
Expected Behavior:
- Call
cex_welfare_get_user_identity(user type determination interface), return result: code=1008 (not logged in). - Output prompt text:
text Please log in to your Gate account first before querying welfare tasks.- Call
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
Expected Behavior:
- Call
cex_welfare_get_user_identity(user type determination interface), return result: code=1008 (not logged in). - Output prompt text:
text Please log in to your Gate account first before querying welfare tasks.- Call
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
Expected Behavior:
- Call
cex_welfare_get_user_identity(user type determination interface), return result: code=1008 (not logged in). - Output prompt text:
text Please log in to your Gate account first before querying welfare tasks.- Call
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file states that all documentation, templates, and instructions were converted to English and describes the skill as English-only. Under the policy rules, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill advertises broad triggers such as welfare benefits, rewards, and tasks without tight scoping, which can cause it to activate for loosely related account, funding, or promotional queries. In an agent system, over-broad activation can misroute users, expose account-state-derived responses unnecessarily, and interfere with safer or more appropriate skills, especially because this skill immediately performs identity-related MCP lookups.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The routing table uses high-level intent labels like 'Query welfare / rewards / tasks' that are too generic for reliable skill selection. This increases the chance of accidental invocation on common exchange questions, leading to incorrect guidance and unnecessary calls to user-identity tooling that reveal user classification states such as existing user, sub-account, or risk-control status.
- Content
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
- Content
md ## General Rules ⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding. Do NOT select or call any tool until all rules are read. These rules have the highest priority. → Read `./references/gate-runtime-rules.md` - **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they exist in the MCP server.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Credentials Source: Local Gate MCP deployment (`GATE_API_KEY`, `GATE_API_SECRET`) - API Key Required: Yes - Permissions: Welfare:Read - Never ask the user to paste secrets into chat; rely on the configured MCP session only. - API Key Provisioning Reference: https://www.gate.com/myaccount/profile/api-key/manage (create or rotate keys outside the chat when the local MCP setup requires them). ### Installation Check
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger scenario uses broad reward-related language, which can cause the skill to activate for generic 'rewards' or 'benefits' queries that may belong to other domains. In practice this can lead to incorrect routing and unintended access to welfare-related account data, though the impact is limited by the skill's read-only MCP tools.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The routing rules include very generic keywords such as 'welfare' and 'rewards' without product or account-context qualifiers. This increases the chance of over-triggering the skill and exposing user identity/task status in response to ambiguous requests, creating a scope and privacy boundary issue rather than a direct code-execution risk.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## 1. MCP Session and Authentication - Use the already configured Gate MCP session for the current host. - Local Gate MCP deployments use `GATE_API_KEY` and `GATE_API_SECRET`; never ask the user to paste these secrets into chat. - Minimal permission for this skill is `Welfare:Read`. - If the required Gate MCP tools are missing, stop and switch to setup guidance only. - If the MCP session returns an auth or permission error, stop and guide the user to repair the configured local MCP credentials before continuing.
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The section titled 'Correct Response Format' provides a fixed English-only output template ('Your exclusive new user tasks are as follows', 'Status: Completed', etc.) with no indication that the user may choose another language. This is a natural-language locale policy concern because the file prescribes a specific language for user-facing output without opt-in or justification.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger examples in Scenario 3 are very broad (e.g. 'what tasks', 'task list') and can match common conversational queries unrelated to welfare. In a routing or skill-selection system, this can cause unintended activation of the welfare skill and misroute users away from the correct capability, especially because the flow then queries account identity and returns account-specific guidance.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The prompt examples include broad phrases like 'What tasks can I do' and 'How can I claim rewards' without strong welfare-specific boundaries. This can lead to accidental invocation of the skill for unrelated task, reward, or workflow questions, creating routing confusion and possible unnecessary tool calls.
- Content