T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:14- Finding
Mutable Remote Rules Are Declared Highest-Priority Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Gate DEX Wallet
Security checks for vulnerabilities and agentic risk
Overview
This wallet skill is not clearly malicious, but it needs Review because it persistently changes agent setup and handles wallet credentials, local binaries, signing, and automatic payments with weak scoping.
Install only if you fully trust the Gate wallet service and are comfortable with persistent agent configuration changes. Before use, verify the missing tx-checkin binaries and their provenance, review changes to MCP configs and CLAUDE.md/AGENTS.md, avoid sudo/global npm installation where possible, do not forward Authorization headers to arbitrary URLs, and require exact payment terms before any x402 payment or signing action.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Findings (8)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/tx-checkin.md:53- Finding
Raw Wallet Authentication Token Is Extracted and Sent to a Secondary Domain
- Content
View full analysis
`** 可指定唯一服务。 - **Override (CI / 无 Cursor 配置)**：`export MCP_TOKEN='<裸 token>'`（会优先于 mcp.json）。 - **自定义配置文件路径**：`CURSOR_MCP_JSON=/path/to/mcp.json` ``` ### Technical Analysis The documented MCP endpoint is `https://api.gatemcp.ai/mcp/dex`, but the mandatory check-in workflow sends the raw authentication token to a separate origin, `https://webapi.w3-api.com`. The workflow searches `~/.cursor/mcp.json` for an `Authorization` header, removes the `Bearer ` prefix, and reuses that credential as a raw authorization value at the second origin. This violates least privilege and token audience separation. The matching strategy can also select credentials based on broad server-name patterns such as `wallet`, `dex`, or `mcp`. The same request includes wallet and signing-intent information, increasing the sensitivity of the disclosure. The main README does not prominently explain that the wallet token will be transmitted to this additional recipient. ### Attack Path 1. The user authenticates to the Gate MCP service, and an authorization token is st ...[truncated 840 chars]- Remediation
View remediation
T07 · Tool Hijacking and Spoofing
Error
- Location
references/tx-checkin.md:40- Finding
Signing Workflow Executes an Unverified Environment-Override Binary
- Content
View full analysis
/dev/null || true "$TX_CHECKIN" \ -path "/api/v1/tx/checkin" \ -wallet "" \ -chain "" \ -chain-category "" \ -message "" ``` ### Technical Analysis The supplied project tree contains no `tools/tx-checkin/bin/` directory, despite the workflow stating that these prebuilt executables are shipped and mandatory. No source code, checksum, signature, or artifact-verification process is present. More importantly, `TX_CHECKIN` can override the executable path. The Agent then makes that file executable and runs it. An inherited environment variable, compromised CI configuration, or malicious shell initialization can redirect execution ...[truncated 992 chars]- Remediation
View remediation
T02 · Agent Memory Poisoning
Error
- Location
install.sh:157- Finding
Installer Persistently Injects Wallet Routing Rules into Agent Control Files
- Content
View full analysis
> CLAUDE.md echo "$routing_content" >> CLAUDE.md echo -e "${GREEN} ✓${NC} CLAUDE.md updated (appended Gate DEX routing)" fi else echo "$routing_content" > CLAUDE.md echo -e "${GREEN} ✓${NC} CLAUDE.md routing file created" fi ``` A materially equivalent block writes to `AGENTS.md` at `install.sh:208-233`, while `install_cli.sh:129-149` can append more routing instructions. ### Technical Analysis `CLAUDE.md` and `AGENTS.md` are persistent project-level Agent instruction files. The installer writes rules that tell future Agent sessions to “strictly follow” this Skill for authentication, transfers, signing, DApp operations, swaps, and other wallet actions. This is not limited to the installation session. It modifies long-lived Agent behavior in the current working project, and the installer does not display a diff, ask for specific consent to modify Agent con ...[truncated 810 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
install_cli.sh:58- Finding
Unpinned npm Package Is Installed Globally and Trusted with Wallet Credentials
- Content
View full analysis
/dev/null; then local current_version current_version=$(gate-wallet --version 2>/dev/null || echo "unknown") echo -e "${YELLOW} ℹ️ gate-wallet already installed (${current_version})${NC}" read -p " Reinstall/upgrade? [y/N] " upgrade if [[ ! "$upgrade" =~ ^[yY]$ ]]; then echo -e "${GREEN} ✓${NC} Keeping current version" return 0 fi fi npm install -g gate-wallet-cli if command -v gate-wallet &> /dev/null; then echo -e "${GREEN} ✓${NC} gate-wallet CLI installed successfully: $(gate-wallet --version 2>/dev/null || echo 'installed')" else echo -e "${RED} ✗${NC} Installation failed, try: sudo npm install -g gate-wallet-cli" exit 1 fi } ``` ### Technical Analysis The installer globally installs the latest available `gate-wallet-cli` package without pinning a version or integrity hash. npm lifecycle scripts may execute during installation, and the installed command is subsequently trusted with OAuth tokens, OpenAPI API keys and secret keys, wallet operations, and custodial signing requests. The suggested fallback to `sudo npm install -g` would further increase the consequences of package compromise. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or a future release. 2. The user runs `install_cli.sh`. 3. npm resolves and globally installs the latest compromised package. 4. Package lifecycle code executes during installation, or malicious runtime code executes when `gate-wallet` is invoked. 5. The package reads `~/.gate-wallet/auth.json` or `~/.gate-dex-openapi/config.json`, changes transaction param ...[truncated 361 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/x402.md:12- Finding
x402 Auto-Payment Can Be Authorized Before Binding Approval to Payment Terms
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/x402.md:67- Finding
Arbitrary URL and Authorization Header Forwarding Enables Credential Disclosure and SSRF
- Content
View full analysis
pay -> retry | #### Parameter Details | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `url` | string | Yes | Full request URL (e.g., `https://webws.gate.io:443/flight/order`) | | `method` | string | No | HTTP method; default `GET` | | `body` | string | No | Request body (e.g., JSON string for POST) | | `headers` | string | No | JSON object of headers, e.g., `{"Content-Type":"application/json"}` | | `mcp_token` | string | No | Auth token; optional if Authorization header is set by client | | `checkin_token` | string | When required by gateway / tool | From successful terminal **tx-checkin** stdout JSON; **always** run check-in **before** this tool (see **Check-in before x402**). | ``` The documentation explicitly demonstrates secret-header forwarding: ```text User: "Call https://api.io/order with header Authorization: Bearer mytoken123" Agent: 1. Run tx-checkin; capture checkin_token. 2. Call dex_tx_x402_fetch({ url: "...", headers: "{\"Authorization\":\"Bearer mytoken123\"}", checkin_token }). ``` ### Technical Analysis The Skill permits arbitrary full URLs, HTTP methods, request bodies, and headers to be forwarded through the remote MCP service. It defines no restrictions for loopback, link-local, private network, cloud metadata, nonstandard ports, redirects, DNS rebinding, or sensitive headers. If the MCP backend can access internal ...[truncated 1016 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
install.sh:97- Finding
Cursor MCP Configuration Is Destructively Overwritten When jq Is Unavailable
- Content
View full analysis
/dev/null; then local existing_config="{}" if [ -f "$config_file" ]; then existing_config=$(cat "$config_file") fi echo "$existing_config" | jq '.mcpServers["gate-dex"] = { "url": "https://api.gatemcp.ai/mcp/dex" }' > "$config_file" else cat > "$config_file" << 'EOF' { "mcpServers": { "gate-dex": { "url": "https://api.gatemcp.ai/mcp/dex" } } } EOF fi ``` ### Technical Analysis When `jq` is not installed, the script uses `cat > "$config_file"` and replaces the entire Cursor MCP configuration. Existing MCP server definitions, headers, environment settings, and security-related configuration are deleted. Even in the `jq` branch, the update writes directly to the destination rather than using a verified temporary file followed by an atomic rename. Invalid JSON or a failed transformation can leave the configuration corrupted. ### Attack Path 1. A user has an existing `~/.cursor/mcp.json` containing unrelated MCP servers. 2. The system does not have `jq`. 3. The user runs `install.sh`. 4. The fallback branch truncates the existing file. 5. Only the Gate MCP server remains, and all previous configuration is lost. ### Impact Assessment The issue causes persistent configuration loss and denial of service for other MCP integrations. It may remove security headers or carefully scoped server settings and can pressure the user into adopting the newly installed server as the only working integration. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (88)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description presents an operational wallet-management skill with specific blockchain-related functions and safety requirements (including mandatory tx-checkin before signing). The actual code chunk is only an installation/configuration shell script for setting up the Gate DEX MCP server and skill routing in various AI clients. Its primary purpose is materially different from the declared runtime wallet functionality. It also performs undeclared local configuration actions and installs unrelated market/trade skills, while none of the core declared behaviors are implemented in this chunk. Therefore the description does not accurately represent what this code actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a wallet-management skill with many runtime capabilities (auth flows, balance/history retrieval, transfers, x402 payments, wallet-connect, contract interactions, and CLI tooling). The supplied code chunk does not implement those wallet operations; its primary purpose is installation and local environment configuration for a CLI. That includes global npm installation, optional AK/SK credential capture, and editing local routing files—capabilities not described in the declared purpose. Additionally, the installer explicitly advertises and configures 'openapi-swap' and shows a swap command in quick start, which conflicts with the declaration that the skill is 'not for token swap execution.' Finally, the declaration emphasizes mandatory terminal tx-checkin for signing MCP calls, but this code neither performs nor enforces such a check. Overall, the code's actual behavior is materially different from the declared operational wallet skill, so this is a mismatch.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh mkdir -p "$skills_dir" for skill in gate-dex-wallet gate-dex-market gate-dex-trade; do if [ -d "$REPO_ROOT/$skill" ]; then rm -rf "$skills_dir/$skill" cp -r "$REPO_ROOT/$skill" "$skills_dir/$skill" echo -e "${GREEN} ✓${NC} Installed: $skill → $skills_dir/$skill" else
MCP Config Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
- Content
sh if claude mcp add --transport http gate-dex --scope project https://api.gatemcp.ai/mcp/dex 2>/dev/null; then echo -e "${GREEN} ✓${NC} MCP server added successfully via CLI" else cat > .mcp.json << 'EOF' { "mcpServers": { "gate-dex": {
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
sh if codex mcp add gate-dex --transport http --url https://api.gatemcp.ai/mcp/dex 2>/dev/null; then echo -e "${GREEN} ✓${NC} MCP server added successfully via CLI" else local config_file="$HOME/.codex/config.toml" mkdir -p "$(dirname "$config_file")" if [ -f "$config_file" ] && grep -q '\[mcp\.gate-dex\]' "$config_file"; then
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
sh transport = "http" url = "https://api.gatemcp.ai/mcp/dex" EOF echo -e "${GREEN} ✓${NC} ~/.codex/config.toml updated" fi fi
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh echo "gate-wallet CLI requires Node.js >= 18" echo "Installation methods:" echo " • macOS: brew install node" echo " • Linux: curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && sudo apt install -y nodejs" echo " • Or visit: https://nodejs.org/" exit 1 fi
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh echo "gate-wallet CLI requires Node.js >= 18" echo "Installation methods:" echo " • macOS: brew install node" echo " • Linux: curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && sudo apt install -y nodejs" echo " • Or visit: https://nodejs.org/" exit 1 fi
MCP Config Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Listing all MCP tools and pairing that with direct-call guidance exposes the available backend capability surface to the agent, making enumeration and subsequent misuse easier. In this context, tool discovery is especially risky because the skill already handles authentication and potentially sensitive wallet operations, so hidden or admin-like tools could become reachable indirectly.
- Content
md |---------|-------------| | `chain-config [chain]` | Chain configuration | | `rpc --chain <c> --method <m> [--params '<json>']` | JSON-RPC call | | `tools` | List all MCP tools | | `call <tool> [json]` | Call any MCP tool directly | ---
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: gate-dex-transfer version: "2026.3.31-2" updated: "2026-03-31" description: "Gate Wallet transfer execution module. Builds transactions, signs, and broadcasts. Use when the user wants to send tokens to an address, including single and batch transfers. Includes mandatory balance verification, user confirmation gate, and terminal tx-checkin before signing. Supports EVM multi-chain and Solana native/token transfers." --- # Gate DEX Transfer > Transfer module — gas estimation, transaction preview, balance verification, **terminal tx-checkin before signing**, signing, and broadcasting. Includes mandatory user confirmation gates. 4 MCP tools + 1 cross-skill
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - **tools/tx-checkin**: Fixed gateway base URL to **`https://webapi.w3-api.com/api/web/v1/web3-gv-api`** (check-in POST: **`.../api/v1/tx/checkin`**). Prebuilt binaries in **`tools/tx-checkin/bin/`** rebuilt. - **tools/tx-checkin**: Optional **`TX_CHECKIN_GATEWAY_BASE`** env (automation/CI only; not user-facing in skill docs) overrides the gateway URL prefix. - **references/cli.md**: version `2026.4.3-1`; tx-checkin integrated as mandatory step in On-Chain Operation Flow (preview → confirm → tx-checkin → execute); `send`, `swap`, `openapi-swap` commands annotated with tx-checkin requirement; new "tx-checkin Binary for CLI Operations" section with step-by-step flows; Security Rules updated (rule 3: terminal tx-checkin before signing); Common Pitfall #24 added; Capability Boundaries updated with signing prerequisite note - **install.sh**: Removed misleading placeholder Bearer token from Cursor and Codex MCP configs (OAuth login populates at runtime); Claude Code install now appends to existing CLAUDE.md instead of overwriting; Codex config.toml checks for existing gate-dex entry before appending; AGENTS.md uses same append-not-overwrite logic; OpenClaw removed hardcoded default API key and unused key prompt - **install_cli.sh**: OpenAPI credential input now escaped via `jq` (with `sed` fallback) to prevent JSON injection from special characters in API keys ## [2026.3.31-2] - 2026-03-31
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README explicitly says the wallet skill is triggered by broad conversation mentions of wallet operations, which can cause the skill to activate in contexts where the user is only discussing concepts rather than requesting execution. In a wallet-management skill that can authenticate, transfer assets, sign messages, and interact with DApps, overbroad activation increases the risk of unintended high-sensitivity actions being initiated or suggested.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
The installation script is described as auto-detecting AI platforms and creating MCP configuration files, which establishes persistent changes to user environments and can silently enable future remote wallet-service access across tools. In the context of a financial wallet skill, session persistence is more dangerous because it can broaden the trust boundary and leave durable integrations that users may not fully understand or later forget remain active.
- Content
md **MCP Installation Script Features**: - 🔍 Auto-detect installed AI platforms (Cursor, Claude Code, Codex CLI, OpenClaw) - ⚙️ Create corresponding MCP Server configuration files for each platform - 🔗 Configure `gate-wallet` MCP Server connection - 📦 Install all Gate DEX Skills (wallet, market, trade)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The listed trigger keywords include generic terms such as "login," "transfer," "approve," and "authorization," which commonly appear in ordinary conversation and in unrelated technical contexts. Because this skill has access to sensitive wallet functions, ambiguous trigger terms raise the likelihood of accidental invocation, misrouting, or prompting users into risky financial actions without a clearly scoped request.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill explicitly instructs the agent to perform terminal-based check-in flows and references prebuilt binaries under tools/tx-checkin/bin/, but the manifest declares no allowed-tools or permissions boundary. In a wallet-management skill that can reach signing paths, omitting an explicit shell/tool scope weakens containment and can let the agent invoke local execution capabilities without clear least-privilege constraints.
- Content
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
- Content
md ## General Rules ⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding. Do NOT select or call any tool until all rules are read. These rules have the highest priority. → Read [gate-runtime-rules.md](https://github.com/gate/gate-skills/blob/master/skills/gate-runtime-rules.md) ## Signing gate — terminal tx-checkin (mandatory)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest states this skill is not for token swap execution, but the CLI routing row includes
openapi-swapandhybrid swapas intents handled by this skill's CLI module. That creates a direct mismatch between the declared boundary and the documented routing behavior.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest description explicitly says the skill should not be used for token swap execution, yet the MCP connection probe treats
dex_tx_quoteanddex_tx_swapas identifying tools for this skill. That ties the skill operationally to swap functionality rather than keeping it confined to wallet/account management.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md existing_config=$(cat "$config_file") fi echo "$existing_config" | jq '.mcpServers["gate-dex"] = { "url": "https://api.gatemcp.ai/mcp/dex" }' > "$config_file" else cat > "$config_file" << 'EOF'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md existing_config=$(cat "$config_file") fi echo "$existing_config" | jq '.mcpServers["gate-dex"] = { "url": "https://api.gatemcp.ai/mcp/dex" }' > "$config_file" else cat > "$config_file" << 'EOF'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md existing_config=$(cat "$config_file") fi echo "$existing_config" | jq '.mcpServers["gate-dex"] = { "url": "https://api.gatemcp.ai/mcp/dex" }' > "$config_file" else cat > "$config_file" << 'EOF'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md existing_config=$(cat "$config_file") fi echo "$existing_config" | jq '.mcpServers["gate-dex"] = { "url": "https://api.gatemcp.ai/mcp/dex" }' > "$config_file" else cat > "$config_file" << 'EOF'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md existing_config=$(cat "$config_file") fi echo "$existing_config" | jq '.mcpServers["gate-dex"] = { "url": "https://api.gatemcp.ai/mcp/dex" }' > "$config_file" else cat > "$config_file" << 'EOF'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md existing_config=$(cat "$config_file") fi echo "$existing_config" | jq '.mcpServers["gate-dex"] = { "url": "https://api.gatemcp.ai/mcp/dex" }' > "$config_file" else cat > "$config_file" << 'EOF'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md existing_config=$(cat "$config_file") fi echo "$existing_config" | jq '.mcpServers["gate-dex"] = { "url": "https://api.gatemcp.ai/mcp/dex" }' > "$config_file" else cat > "$config_file" << 'EOF'
Static analysis
No suspicious patterns detected.