Gate Pay Payment Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:30 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed Gate Pay payment tool, but it needs Review because it can execute irreversible payments with broad intent triggers and mutable external runtime instructions.

Install only if you are comfortable with an AI assistant initiating Gate Pay charges from your authenticated account. Before any payment, require the assistant to show the merchant, order ID, exact amount, currency, and payment method, then ask for a fresh explicit approval for those exact details. Be aware that some required runtime rules are pulled from mutable external documents rather than being fully bundled in this reviewed package.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:12

Finding

Externally Hosted Instructions Are Assigned Highest Priority

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–15
Vulnerability Type: Untrusted remote instruction override
Risk Level: Critical

Vulnerable Code

markdown

⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding.
Do NOT select or call any tool until all rules are read. These rules have the highest priority.
→ Read [gate-runtime-rules.md](https://github.com/gate/gate-skills/blob/master/skills/gate-runtime-rules.md)
- **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they
  exist in the MCP server.

A second remote instruction reference appears at SKILL.md:202:

markdown

Before calling any payment-related tools, follow the Agent and MCP usage rules shipped with this product, and comply with [exchange-runtime-rules.md](https://github.com/gate/gate-skills/blob/master/skills/exchange-runtime-rules.md).

Technical Analysis

The skill requires the agent to retrieve and obey instructions from remote GitHub documents that are not included in the audited package. It also declares that these remote rules have the “highest priority.” Because the links reference a mutable branch rather than an immutable commit, their content may change after the skill has been reviewed.

This creates an instruction-hijacking boundary: anyone able to compromise or legitimately modify the referenced repository, branch, account, or documents can alter the effective behavior of the installed skill without changing this audited artifact. The risk is particularly significant because the skill is designed to invoke an authenticated write operation that debits a user's Gate Pay balance.

The remote documents are instruction payloads rather than executable source code, so the best matching classification is Skill Instruction Hijacking rather than remote code execution.

Attack Path

1. A user or agent loads this Ga ...[truncated 1349 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle all mandatory runtime rules inside the reviewed skill package rather than loading them from mutable remote locations.
2. If remote references are operationally unavoidable, pin each reference to an immutable commit hash instead of the master branch.
3. Verify downloaded documents against a cryptographic digest or trusted signature before using them.
4. Remove language asserting that skill-provided or remotely retrieved instructions have the “highest priority.”
5. Explicitly state that neither local nor remote skill instructions can override system instructions, developer instructions, platform safety policies, or the user's current authorization.
6. Restrict remote documents to informational guidance and prevent them from expanding tool permissions or changing payment confirmation requirements.
7. Require security review and versioned release management whenever an instruction dependency changes.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:108

Finding

Irreversible Payment Can Execute Without Transaction-Specific Final Confirmation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 108–124
Vulnerability Type: Insufficient confirmation for an irreversible financial operation
Risk Level: High

Vulnerable Code

markdown

### Step 2: Present Payment Details (Optional)

**Action**: Display key charge details for user verification. This is informational and does not require an explicit forced confirmation step. It does **not** replace Step 1: calling the payment tool still requires the clear payment intent established there (see **Safety Rules**).

**Key data to extract**:
- Merchant order ID
- Amount and currency
- Payment method (Gate Pay)

**Output format**:

Planned charge Merchant order ID: {order_id} Amount due: {amount} {currency} Payment method: Gate Pay

text

**Decision**: Proceed to Step 3 after displaying details when Step 1's payment-intent gate is satisfied; the optional display is for transparency only.

The confirmation policy is reinforced at SKILL.md:259–263:

markdown

This skill follows a streamlined confirmation model for payment execution:

1. **User intent confirmation**: The user must clearly express payment intent (e.g., "pay", "confirm payment", "checkout")
2. **Parameter verification**: Payment details (order ID, amount, currency) may be displayed for user verification, but no additional forced confirmation step is required beyond clear payment intent
3. **Single-use confirmation**: Each payment intent is single-use. If parameters or merchant details change, re-confirm intent is required

Technical Analysis

The skill performs an authenticated, irreversible financial write but makes presentation of the resolved transaction details optional. It accepts generic intent expressions such as “pay” or “checkout” without requiring the user to approve the final merchant, order identifier, amount, and currency after those values have been extracted from conversation context.

C ...[truncated 1744 chars]

Remediation

View remediation

Remediation Suggestions

1. Always display the final merchant identity, merchant order ID, exact amount, currency, and payment method before executing a charge.
2. Require a fresh, explicit confirmation after displaying those resolved values.
3. Bind the confirmation to immutable transaction parameters so that it becomes invalid if the merchant, order ID, amount, currency, or other required field changes.
4. Do not treat generic intent from an earlier turn as sufficient authorization for a subsequently resolved transaction.
5. Assign a short expiration period to confirmations and require reconfirmation after authorization renewal, material context changes, or delays.
6. Use a server-side idempotency key and duplicate-payment protection in addition to conversation-level tracking.
7. Validate that merchant-supplied content cannot issue instructions or silently replace payment parameters.
8. Record a concise confirmation summary for auditability without storing credentials or other unnecessary sensitive data.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

- `SKILL.md` keeps payment intent routing, product boundaries, and user-facing policy.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example intents are too generic for a skill that can execute financial transactions, making it easier for downstream systems or agent routing logic to over-associate normal conversational phrases with payment authorization. Because the skill handles irreversible digital asset payments, ambiguous examples materially increase the chance of unsafe triggering or misinterpretation of user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to match ordinary payment-related conversation, which creates a real risk that the skill could activate in contexts where the user is discussing payment rather than authorizing an irreversible transaction. In a payment-execution skill, accidental invocation is especially dangerous because it can lead to unintended charges or pressure the agent into a payment flow from ambiguous language.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

## General Rules

⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding.
Do NOT select or call any tool until all rules are read. These rules have the highest priority.
→ Read [gate-runtime-rules.md](https://github.com/gate/gate-skills/blob/master/skills/gate-runtime-rules.md)
- **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they
  exist in the MCP server.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/scenarios.md (reported line 284)May include surrounding context.

md

**Unexpected Behavior**:
1. Executes duplicate payment without detecting prior charge in conversation.
2. Does not warn user about duplicate; charges twice for same order.
3. Assumes user wants to pay twice without confirmation.

## Scenario 11: Payment Status Query Without Query Tool