Gate Exchange Transfer

ReviewAudited by ClawScan on May 1, 2026.

Overview

The skill matches its stated purpose and includes confirmation safeguards, but it needs Gate credentials that can move crypto funds between account types.

Install only if you intend to let the agent help move funds between your own Gate account types. Use a dedicated least-privilege API key, verify the Gate MCP installation, never paste secrets into chat, and confirm a transfer only after checking every detail in the draft.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A misconfigured or over-privileged API key could expose more account authority than the user intends.

Why it was flagged

The skill requires authenticated Gate API credentials with wallet write authority, which is expected for transfers but gives the agent delegated ability to move funds if the user confirms.

Skill content
required_env_vars: GATE_API_KEY, GATE_API_SECRET ... required_permissions: ... Wallet:Write
Recommendation

Use a dedicated least-privilege Gate API key limited to the listed read scopes and the minimum wallet-transfer permission needed; avoid enabling withdrawal permissions if Gate allows separating them.

What this means

If the user confirms incorrect transfer details, funds may move to the wrong Gate account type and the transfer may be difficult to undo.

Why it was flagged

The skill uses a real write-capable MCP tool to execute financial transfers, but the same artifact requires a draft and explicit confirmation before calling it.

Skill content
cex_wallet_create_transfer | execute account-to-account transfer ... Require explicit confirmation.
Recommendation

Review the source account, destination account, currency, amount, and risk note in the transfer draft before replying with confirmation.

What this means

A user must trust the local Gate MCP deployment because it will handle API credentials and submit transfer requests.

Why it was flagged

The skill itself is instruction-only, but execution depends on a separately installed Gate MCP server that is not included in the skill bundle.

Skill content
Required MCP Servers ... Gate (main) ... Install: Use the local Gate MCP installation flow for the current host IDE before continuing.
Recommendation

Install the Gate MCP only from the official or trusted source and verify it exposes only the expected Gate tools before using this skill.