Gate Exchange Auto-Invest Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:37 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Gate auto-invest helper, but it needs review because it delegates highest-priority runtime instructions to an unbundled mutable rules file while handling live financial account actions.

Review this skill before installing on an account with trading permissions. It should be safest if the shared runtime rules are bundled or pinned to an immutable version, write tools always show a clear Action Draft with amount, cadence, fund source, and destination, and no create/update/stop/top-up action runs without a fresh explicit confirmation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:14

Finding

External Mutable Instructions Are Assigned Highest Priority

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–17
Vulnerability Type: External instruction takeover
Risk Level: High

Vulnerable Code

markdown

⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding.
Do NOT select or call any tool until all rules are read. These rules have the highest priority.
→ Read [`exchange-runtime-rules.md`](../exchange-runtime-rules.md) first (mirror: [`exchange-runtime-rules.md` on GitHub](https://github.com/gate/gate-skills/blob/master/skills/exchange-runtime-rules.md)).
- **Only call MCP tools explicitly listed in this skill** (see **MCP tools** below: Auto-Invest Related Tools and Supporting Tools). Tools not documented here must NOT be called, even if they exist in the MCP server.

Technical Analysis

The skill requires the agent to load another instruction document before selecting or invoking tools and assigns that document the “highest priority.” The referenced local file, ../exchange-runtime-rules.md, is outside the audited project and was not present in the supplied directory structure. The skill also provides a mutable GitHub master branch URL as a mirror.

Consequently, the effective behavior of the skill is not fully defined by the reviewed package. Instructions retrieved from the external location can change after audit without changing this project. Assigning those unseen instructions elevated priority creates an instruction-hijacking boundary: whoever controls the referenced repository, branch, delivery channel, or fetched content may influence the agent’s goals, safeguards, data handling, and tool-use decisions.

Although the visible package limits calls to named Gate MCP tools and requires confirmation for financial writes, those local safeguards cannot reliably constrain an external document that is explicitly described as having the highest priority.

Attack Path

1. A user loads or invokes the auto-invest skill.
2. Lines 14–17 instruct t ...[truncated 1790 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle exchange-runtime-rules.md inside the audited skill package so its complete contents are reviewed and versioned together with the skill.
2. Replace the parent-directory reference with a package-relative path that cannot silently resolve to an unaudited file.
3. Remove language assigning “highest priority” to externally loaded content. State that referenced documentation must remain subordinate to platform, system, developer, and package-local security constraints.
4. Do not use a mutable branch URL as an authoritative instruction source. If an external reference is necessary:
   • Pin it to an immutable commit.
   • Verify its expected cryptographic hash.
   • Fail closed if retrieval or verification fails.
   • Treat retrieved content as untrusted documentation rather than executable agent instructions.
5. Define all critical controls locally, including the allowed-tool list, explicit confirmation requirements, stale-confirmation invalidation, amount and balance validation, and one-call top-up restriction.
6. Add a policy stating that missing runtime rules must stop the workflow rather than trigger automatic fallback to mutable remote instructions.
7. Include the pinned runtime-rules file and its integrity metadata in future security reviews and release artifacts.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (16)

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/autoinvest-plans.md (reported line 198)May include surrounding context.

md

1. Check balance via `cex_spot_get_spot_accounts`
2. If insufficient → do not create; explain shortfall
3. If sufficient → confirm once, then create (see `autoinvest-plans.md` → Scenario 3)

---

## Scenario 4: Create with auto Simple Earn after buy

**Context**: User wants purchased assets moved to Simple Earn when product supports it.

**Prompt Examples**:
- "Weekly 50 USDT into BTC, auto-send BTC to Simple Earn."

**Expected Behavior**:
1. Pass product flags via create tool when MCP exposes them
2. If unclear whether feature exists, say so and offer standard create; full steps in `autoinvest-plans.md` → Scenario 4

---

## Scenario 5: Named plan + frequency

**Context**: User gives a display name and schedule.

**Prompt Examples**:
- "Name it 'BTC dip', 20 USDT daily into BTC."

**Expected Behavior**:
1. Include plan name + daily cadence + amount in create payload per MCP schema (`autoinvest-plans.md` → Scenario 5)

---

## Scenario 6: Vague intent (no write yet)

**Contex

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/scenarios.md (reported line 58)May include surrounding context.

md

1. Check balance via `cex_spot_get_spot_accounts`
2. If insufficient → do not create; explain shortfall
3. If sufficient → confirm once, then create (see `autoinvest-plans.md` → Scenario 3)

---

## Scenario 4: Create with auto Simple Earn after buy

**Context**: User wants purchased assets moved to Simple Earn when product supports it.

**Prompt Examples**:
- "Weekly 50 USDT into BTC, auto-send BTC to Simple Earn."

**Expected Behavior**:
1. Pass product flags via create tool when MCP exposes them
2. If unclear whether feature exists, say so and offer standard create; full steps in `autoinvest-plans.md` → Scenario 4

---

## Scenario 5: Named plan + frequency

**Context**: User gives a display name and schedule.

**Prompt Examples**:
- "Name it 'BTC dip', 20 USDT daily into BTC."

**Expected Behavior**:
1. Include plan name + daily cadence + amount in create payload per MCP schema (`autoinvest-plans.md` → Scenario 5)

---

## Scenario 6: Vague intent (no write yet)

**Contex

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · CHANGELOG.md (reported line 9)May include surrounding context.

md

- **gate-exchange-autoinvest** skill for Gate Exchange Earn DCA: eleven earn auto-invest MCP tools plus supporting `cex_spot_get_spot_accounts` and `cex_earn_list_user_uni_lends`; documentation uses MCP tool names only (no REST paths in skill text).
- **references/scenarios.md** (16-scenario index), **references/autoinvest-plans.md**, and **references/autoinvest-compliance.md** with workflows, prompt examples, response templates, and compliance-facing rules.
- **SKILL.md** as router: feature modules, MCP tools, routing, execution, domain knowledge, safety (mandatory confirmation, stale Action Draft invalidation, **default: no write without confirmation** for gate-skill-cr 12.4, add-position call exactly once), error handling, judgment summary, and report templates.
- **Business rules**: USDT/BTC investment currency; `plan_period_day` by `plan_period_type`; multi-target limits (≤10 targets, ≥10% per coin); min/max from MCP; on-the-hour UTC `plan_period_hour`; `fund_flow` mapping (Simple Earn vs spot).
- **Operational alignment**: link to **exchange-runtime-rules.md**; parameter hygiene when the MCP schema requires a value with no default; **README** architecture and file map.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 319)May include surrounding context.

md

- **gate-exchange-autoinvest** skill for Gate Exchange Earn DCA: eleven earn auto-invest MCP tools plus supporting `cex_spot_get_spot_accounts` and `cex_earn_list_user_uni_lends`; documentation uses MCP tool names only (no REST paths in skill text).
- **references/scenarios.md** (16-scenario index), **references/autoinvest-plans.md**, and **references/autoinvest-compliance.md** with workflows, prompt examples, response templates, and compliance-facing rules.
- **SKILL.md** as router: feature modules, MCP tools, routing, execution, domain knowledge, safety (mandatory confirmation, stale Action Draft invalidation, **default: no write without confirmation** for gate-skill-cr 12.4, add-position call exactly once), error handling, judgment summary, and report templates.
- **Business rules**: USDT/BTC investment currency; `plan_period_day` by `plan_period_type`; multi-target limits (≤10 targets, ≥10% per coin); min/max from MCP; on-the-hour UTC `plan_period_hour`; `fund_flow` mapping (Simple Earn vs spot).
- **Operational alignment**: link to **exchange-runtime-rules.md**; parameter hygiene when the MCP schema requires a value with no default; **README** architecture and file map.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README advertises account-affecting actions such as creating, updating, stopping, and topping up auto-invest plans, but it does not prominently warn that these operations can trigger real financial changes on a live exchange account. In an agent skill context, that omission is dangerous because it can normalize execution of trading-related actions without explicit user confirmation or clear disclosure of monetary consequences.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrase section ends with broad language such as 'or equivalent,' which can cause the skill to activate on loosely related requests. In a financial trading context, over-broad routing increases the chance the agent enters a high-risk workflow and begins balance checks, plan lookups, or draft write operations for a user intent that was not actually about auto-invest.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

## General Rules

⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding.
Do NOT select or call any tool until all rules are read. These rules have the highest priority.
→ Read [`exchange-runtime-rules.md`](../exchange-runtime-rules.md) first (mirror: [`exchange-runtime-rules.md` on GitHub](https://github.com/gate/gate-skills/blob/master/skills/exchange-runtime-rules.md)).
- **Only call MCP tools explicitly listed in this skill** (see **MCP tools** below: Auto-Invest Related Tools and Supporting Tools). Tools not documented here must NOT be called, even if they exist in the MCP server.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document explicitly says the expected behavior is to 'explain rule in English,' which imposes a language choice regardless of the user's language preference. The policy only permits locale or language constraints when the user is offered a choice or the constraint is clearly justified and documented.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The heading labels the sample as 'Sample output (English),' indicating a prescribed language for user-facing compliance messaging. This is a natural-language policy issue because it forces a specific language without offering a user choice or documenting a necessary locale constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill enables create, update, stop, and top-up operations for auto-invest plans without an upfront warning that these are state-changing financial actions that can schedule future recurring purchases. Users may not appreciate that these actions affect funds and future automated deductions unless the risk is surfaced before workflow execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs the agent to run a shell command (date +"%Z %z") to inspect host environment state even though auto-invest scheduling can be handled by asking the user for their timezone. Expanding the skill to invoke host commands increases attack surface and creates an unnecessary precedent for system introspection from untrusted skill content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill directs collection of user-environment timezone data via a shell command without disclosing that host/system metadata may be accessed. Even if the data seems low sensitivity, undisclosed environment probing is a privacy and trust issue, especially in a financial context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This repeats the same unsafe pattern by directing the agent to execute a host date command during scenario handling. Repetition in operational guidance makes accidental implementation more likely and normalizes unnecessary command execution in a financial automation skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction 'Use Response Template style below; English user-facing text' forces a specific language for responses. Under the policy, locale or language restrictions should not be imposed without user opt-in or a clearly justified documented constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file explicitly says 'Use English for user-facing text,' which is a language policy constraint. There is no opt-in, alternative language option, or documented compliance reason for restricting output to English.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file includes examples such as "auto-invest wealth management" and especially "I want DCA," which are broad, natural phrases that could overlap with ordinary user intent without clearly defining when the skill should activate. Although the scenario says no write should occur yet, the trigger scope itself is still underspecified and lacks explicit exclusions or negative examples.

Content

No source excerpt is available for this finding.