Security audit
Security checks for vulnerabilities and agentic risk
This skill is a read-only exchange listing tracker with disclosed Gate MCP data use and no evidence of hidden persistence, credential access, or destructive behavior.
Before installing, confirm you trust the Gate MCP server configured in your IDE. Expect the skill to query public exchange announcements and market/token metadata, and treat its new-listing summaries as informational rather than trading advice.
The manifest declares required_permissions: [] at L008, which establishes no declared permissions baseline. Yet the skill explicitly depends on the Gate-News MCP server and multiple MCP query tools at L031-L040 and instructs installation/use of that server at L046-L049. This is broader operational access than the manifest's empty permissions declaration suggests.
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
## General Rules
⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding.
Do NOT select or call any tool until all rules are read. These rules have the highest priority.
→ Read `./references/gate-runtime-rules.md`
→ Also read `./references/info-news-runtime-rules.md` for gate-info / gate-news shared rules (tool degradation, report standards, security, routing, and graceful fallback behavior).
- **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they
The trigger scenario includes broad language like asking about 'any new projects,' which can overlap with unrelated general news or research requests. Over-broad activation can misroute user queries into this skill, causing inappropriate tool use, irrelevant data retrieval, and incorrect responses that may bypass more suitable domain-specific safeguards.
The routing rule for 'what happened recently' is too generic and insufficiently scoped, which increases the chance of accidental invocation or misrouting between overlapping news skills. In agent systems, ambiguous routing can lead to unintended tool access patterns and responses based on the wrong operational policy set.
The file defines Scenario 1 as "(English)" and Scenario 2 as "(Chinese)" as fixed interaction modes, but does not state that language should be selected based on the user's preference. This can violate language/locale policy expectations by hard-coding a response language without user opt-in.
The manifest description at L005 says the skill's MCP tools are news_feed_get_exchange_announcements, info_coin_get_coin_info, and info_marketsnapshot_get_market_snapshot. However, the skill file later lists info_coin_get_coin_rankings under 'MCP Tools Used' at L037-L040, creating a mismatch between the claimed tool scope and the documented behavior.
The scenario lists trigger-like prompt examples such as "Any new coins listed recently" and "What did Binance list this week" without clarifying boundaries, exclusions, or how narrowly the skill should match requests. In a scenario/reference markdown file, this can create ambiguity about when the skill should activate versus when general market-news questions should not invoke it.