gate-exchange-welfare

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a scoped, read-only Gate welfare-task helper, but it needs Gate API credentials through MCP, so users should use a least-privilege key.

Before using this skill, confirm you are using the official or trusted Gate MCP setup and configure a dedicated Gate API key with only Welfare:Read access. Do not paste API secrets into chat, and use separate official Gate flows or dedicated skills for any trading, deposits, or reward-claiming actions.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Using the skill gives the configured Gate MCP session access to account-specific welfare eligibility and task data.

Why it was flagged

The skill requires Gate API credentials, but the declared permission is limited to reading welfare data.

Skill content

required_credentials:
  - gate_api_key
  - gate_api_secret
required_permissions:
  - Welfare:Read

Recommendation

Use a dedicated Gate API key limited to Welfare:Read, avoid over-scoped trading or withdrawal permissions, and never paste the secret into chat.

Info

#ASI07: Insecure Inter-Agent Communication

What this means

Your welfare eligibility, account restriction category, and beginner task/reward data may be returned through the configured Gate MCP tools.

Why it was flagged

The skill retrieves user-specific Gate account status and task data through an authenticated MCP channel; the artifacts disclose this and bound it to welfare queries.

Skill content

Authenticated context/API key required for user-specific identity and tasks.

Recommendation

Use only a trusted local Gate MCP deployment and avoid sharing MCP outputs if they reveal account status or reward eligibility you consider private.