ClawHub
Back to skill

Security audit

Gate Exchange Coupon

Security checks for vulnerabilities and agentic risk

Overview

This skill is a read-only Gate coupon lookup helper, but it should only be used with a tightly scoped Gate API key.

Install only if you are comfortable connecting it to your Gate account through local MCP. Use a Gate API key limited to Coupon:Read, do not grant trading, transfer, withdrawal, or redemption permissions, and do not paste API secrets into chat.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger phrases are broad enough to activate on casual or ambiguous coupon-related conversation, which can cause the skill to run in unintended contexts. In an agent setting, overbroad activation can lead to unnecessary account data retrieval or disclosure of coupon information when the user did not clearly request an authenticated coupon query.

Vague Triggers

Low
Confidence
84% confidence
Finding
Using a generic follow-up trigger like "load more" without binding it to the prior coupon-list context creates a context-confusion risk. Another conversation turn or skill could inadvertently consume the phrase and continue pagination, potentially exposing additional coupon records the user did not explicitly ask to reveal in that moment.

Static analysis

No suspicious patterns detected.