Gate Exchange Alpha

• Outcome: Review
• Latest audit: Sep 15, 2026 · 2:23 AM UTC
• Version: 1.0.1

Overview

This appears to be a legitimate Gate Alpha trading assistant, but it needs review because it handles real account data and trades while relying on mutable or unpinned external instructions and installers.

Install only if you intentionally want an agent to access Gate Alpha account data and help place trades. Use the least-privilege credentials possible, prefer read-only access for market or history tasks, verify installer provenance manually, and require a fresh quote plus explicit confirmation before any buy, sell, or sell-all action.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:14

Finding

Mutable Remote Instructions Are Assigned Highest Priority

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–17
Vulnerability Type: Remote instruction override through a mutable external document
Risk Level: Critical

markdown

⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding.
Do NOT select or call any tool until all rules are read. These rules have the highest priority.
→ Read [gate-runtime-rules.md](https://github.com/gate/gate-skills/blob/master/skills/gate-runtime-rules.md)
- **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they
  exist in the MCP server.

Technical Analysis

The Skill requires the Agent to retrieve instructions from an external GitHub URL and explicitly declares those instructions to have the “highest priority.” The URL references the mutable master branch rather than an immutable commit. Consequently, the effective Skill instructions can change after the local package has been reviewed.

This creates an instruction-hijacking boundary: anyone able to modify the referenced repository content, compromise the repository, or influence remote content delivery could alter the Agent's behavior without changing the audited artifact. The priority statement compounds the issue by attempting to elevate unaudited external content over the Skill's local controls.

Although no malicious remote payload was established during this static audit, the local instruction itself creates a confirmed mechanism through which mutable external text can control the current Agent session.

Attack Path

1. A user invokes the Skill for an Alpha market or trading operation.
2. The Agent loads SKILL.md.
3. Lines 14–16 require the Agent to retrieve the remote runtime-rules document from the mutable master branch.
4. An attacker with control over the remote repository, its publishing process, or content delivery modifies that document.
5. The modified d ...[truncated 977 chars]

Remediation

View remediation

Remediation Suggestions

1. Vendor the complete runtime rules into the Skill package so they are reviewed together with the rest of the artifact.
2. If external retrieval is unavoidable, reference an immutable commit rather than master.
3. Publish and verify a cryptographic digest or signature for the external document before processing it.
4. Remove the statement that remote instructions have the “highest priority.”
5. Explicitly state that all Skill and remote instructions remain subordinate to platform, system, developer, user-authorization, and transaction-safety constraints.
6. Fail closed if the pinned content cannot be retrieved or its integrity cannot be verified.
7. Prevent external runtime rules from changing the approved MCP tool allowlist or bypassing quote, confirmation, and order-verification controls.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:51

Finding

Unpinned External Installer Skills Create a Supply-Chain Boundary

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 51–57
Vulnerability Type: Unversioned and unaudited installer dependencies
Risk Level: Medium

markdown

### Installation Check
- Required: Gate (main)
- Install: Run installer skill for your IDE
  - Cursor: `gate-mcp-cursor-installer`
  - Codex: `gate-mcp-codex-installer`
  - Claude: `gate-mcp-claude-installer`
  - OpenClaw: `gate-mcp-openclaw-installer`

Technical Analysis

The Skill directs users or Agents to run external installer Skills identified only by name. It provides no immutable version, source URL, package digest, signature, or expected publisher identity. The installer implementations are not included in the audited project.

Name-only dependency resolution is vulnerable to registry compromise, dependency confusion, namespace takeover, or later replacement of a previously legitimate installer. This risk is especially significant because the resulting MCP integration may process authenticated account data and submit Alpha orders.

The audit did not establish that any named installer is currently malicious. The confirmed weakness is the absence of verifiable provenance and immutable dependency pinning at a security-sensitive installation boundary.

Attack Path

1. The required Gate MCP server is unavailable in the user's environment.
2. The Skill directs the user or Agent to invoke an installer solely by its unversioned name.
3. A registry, marketplace, repository, or name-resolution mechanism returns a compromised or attacker-controlled installer with that name.
4. The installer deploys a modified MCP server or configuration while presenting itself as the legitimate Gate integration.
5. The spoofed component observes authenticated requests, captures credentials made available to it, falsifies quotes or responses, or redirects trading operations.
6. Subsequent calls from the Skill are sent to the compromised integration.

...[truncated 705 chars]

Remediation

View remediation

Remediation Suggestions

1. Specify an authoritative source and verified publisher for every installer Skill.
2. Pin each installer to an immutable, reviewed version or commit.
3. Publish and validate cryptographic checksums or signatures before installation.
4. Require explicit user approval before running an installer or changing MCP configuration.
5. Verify the installed MCP server's identity, exposed tool schema, and endpoint allowlist before providing credentials.
6. Use least-privilege API keys. Prefer read-only credentials unless the user explicitly requires trading functionality.
7. Keep trading credentials separate from installation and validation steps.
8. Document a trusted manual installation method and fail closed when provenance verification is unavailable.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md

- `SKILL.md` keeps module dispatch and business boundaries.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README expands the skill from Alpha token browsing/trading into broader account management, portfolio valuation, transaction history, and order management, which exceeds the narrower user-facing description. This creates scope ambiguity that can cause the agent to invoke authenticated actions or data access beyond what a user would reasonably expect from the manifest metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README describes trading, holdings, and transaction-history features without prominent warnings that the skill can access account data and facilitate financial actions. In a brokerage-like context, missing disclosure undermines informed consent and increases the chance users trigger sensitive read/write operations without understanding the consequences.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Documenting account-book and transaction-history access under an Alpha token skill broadens the effective capability from market interaction to sensitive financial record retrieval. Even without code execution, this mismatch increases the risk of over-collection or unexpected access to private account data when the skill is selected.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README advertises authenticated tools for balances, order placement, order history, and account-book queries that go beyond a narrowly described token-market browsing skill. In a financial context, undocumented authenticated capabilities are especially risky because they enable access to sensitive account data and potentially irreversible trades under an unexpectedly broad trust boundary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Broad trigger phrases such as generic buy/sell terms in English and Chinese can cause accidental skill activation from ordinary conversation. Because this skill includes financial trading and account access, unintended routing is more dangerous than in low-risk domains and could lead to unnecessary exposure of balances or progression toward trades.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

## General Rules

⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding.
Do NOT select or call any tool until all rules are read. These rules have the highest priority.
→ Read [gate-runtime-rules.md](https://github.com/gate/gate-skills/blob/master/skills/gate-runtime-rules.md)
- **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they
  exist in the MCP server.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill instructs the agent to retrieve and display detailed Alpha account transaction history, including timestamps, token symbols, balance changes, and resulting balances, but provides no user-facing warning or confirmation step about exposing sensitive financial data. In a trading/account context, this increases the risk of unintended disclosure to someone with access to the session, screen, logs, or shared chat history.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file describes showing all tokens held in the user's Alpha account, including balances, chain, and contract address, but provides no warning that the output may reveal sensitive financial information. Under the markdown criteria for missing user warnings, skills that affect user privacy should disclose that behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The description directs the skill to query all holdings and compute total portfolio value, which involves processing sensitive financial account data. The markdown does not include any privacy or data-handling warning for this behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file expands from token-specific Alpha trading into a workflow that includes 'batch sell all holdings,' which materially broadens the action scope from what the skill metadata suggests. In a trading skill, undocumented or under-disclosed account-wide liquidation behavior increases the chance that a user or downstream agent triggers destructive transactions beyond the user’s apparent intent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Scenario 14 introduces full-account liquidation logic, allowing sequential sale of every available Alpha holding after confirmation. Even though the scenario includes confirmations, this is still dangerous because it gives the skill a far broader transactional capability than its stated purpose implies, creating a mismatch that can lead to excessive, irreversible financial actions if the skill is invoked under narrower user expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The README presents both English and Chinese invocation examples and trigger phrases, but it does not explain whether the skill is bilingual by design, how language is selected, or whether a user can choose their preferred language. This can create ambiguity around language/locale behavior and may conflict with organizational expectations for explicit language handling.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file includes example prompts like "How's the Alpha market doing?" and especially "What's the market like right now?" without clarifying boundaries or exclusions. Those phrases are fairly broad and could match casual discussion rather than an explicit request to invoke this skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The file includes multiple Chinese prompt examples alongside English ones, but nowhere states that the skill supports multiple languages or lets the user choose a preferred language/locale. This can create an implicit language expectation without explicit opt-in, which falls under locale/language policy concerns.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The file includes mixed Chinese and English prompt examples and implicitly steers usage toward those languages, but it does not explicitly state that users may interact in their preferred language or that the skill is limited to a particular locale. Under the policy rule, language constraints should be opt-in or clearly justified.

Content

No source excerpt is available for this finding.