v1.0.1

Gate Exchange Multi-Collateral Loan

ReviewClawScan verdict for this skill. Analyzed May 1, 2026, 8:30 AM.

Analysis

The skill is aligned with Gate loan management, but it can use financial write access and contains instruction/provenance ambiguities that should be reviewed before installation.

GuidanceOnly install this if you intend to let an agent help manage Gate multi-collateral loans. Verify the Gate MCP source and the referenced runtime rules, use a tightly scoped API key, and require a clear draft plus explicit confirmation before any loan creation, repayment, or collateral adjustment.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityMediumConfidenceHighStatusConcern

SKILL.md

Read [gate-runtime-rules.md](https://github.com/gate/gate-skills/blob/master/skills/gate-runtime-rules.md) ... These rules have the highest priority.

The skill delegates core runtime behavior to a remote, unpinned GitHub master-branch document that is not included in the reviewed artifacts, while making it authoritative before any tool use.

User impactThe behavior of the skill could change if that remote rules file changes, including in a financial workflow.

RecommendationReview and pin the referenced runtime rules, or include the exact approved rules with the skill package before installing.

Tool Misuse and Exploitation

SeverityMediumConfidenceHighStatusConcern

SKILL.md

**Query Operations (Read-only)** ... - cex_mcl_operate_multi_collateral ... Step 5: Add or redeem collateral ... call `cex_mcl_operate_multi_collateral`

The same tool is labeled read-only while later being used for collateral add/redeem actions, which are account-mutating financial operations.

User impactAn agent could misunderstand approval requirements for collateral adjustments, potentially affecting liquidation risk or account balances.

RecommendationTreat `cex_mcl_operate_multi_collateral` as a write/mutation tool everywhere and require an explicit, immediate user confirmation before every call.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityMediumConfidenceHighStatusNote

SKILL.md

API Key Required: Yes ... Permissions: Mcl:Write

The skill requires delegated Gate account authority capable of multi-collateral loan write operations.

User impactIf installed with a sufficiently privileged API key, the agent can create loans, repay loans, and adjust collateral after confirmation.

RecommendationUse the narrowest possible Gate API key, restrict it to the required multi-collateral loan permission, and confirm every draft carefully before proceeding.