Security audit

Gate Spot Exchange Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate-looking Gate spot-trading skill, but it controls real exchange orders and contains inconsistent TP/SL guidance plus broad activation language that needs review before use.

Review this skill carefully before installing because it can place, amend, and cancel real Gate spot orders using your configured API key. Use a restricted Gate API key, confirm every draft manually, and be especially cautious with TP/SL requests until the contradictory support statement is fixed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (17)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
md
- `SKILL.md` remains the intent routing and scenario map.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly supports trigger-order workflows for take-profit/stop-loss in multiple sections, but the Safety Rules later state 'If user asks for TP/SL, do not pretend support; clearly state it is not supported.' This contradiction can cause an agent to deny supported protective orders or behave inconsistently during high-risk trading actions, increasing the chance of incorrect order handling and financial loss.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list is broad enough to match ordinary trading language such as 'buy', 'sell', 'rebalance', or 'cancel order', which creates a real risk of over-activation. In a skill that can place real exchange orders, ambiguous activation boundaries are dangerous because the assistant may invoke this skill in contexts where the user intended discussion, analysis, or hypothetical planning rather than execution-oriented trading flows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger description uses broad phrases such as 'buy coin', 'sell spot', 'take profit', 'stop loss', and 'cancel order' without clear exclusions or tighter routing criteria. In a trading environment, this can cause accidental invocation from ordinary discussion or ambiguous user intent, potentially leading the agent into sensitive account or order-management flows.
Content: No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
md
## General Rules ⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding. Do NOT select or call any tool until all rules are read. These rules have the highest priority. → Read `./references/gate-runtime-rules.md` - **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they exist in the MCP server.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.
md
- Credentials Source: Local Gate MCP deployment (`GATE_API_KEY`, `GATE_API_SECRET`) - API Key Required: Yes - Permissions: Spot:Write, Wallet:Read - Never ask the user to paste secrets into chat; rely on the configured MCP session only. - API Key Provisioning Reference: https://www.gate.com/myaccount/profile/api-key/manage (create or rotate keys outside the chat when the local MCP setup requires them). ### Installation Check

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.
md
1. Send order draft (no trading call yet) 2. Wait for explicit user approval 3. Only after approval, submit the real order 4. Without approval, perform query/estimation only, never execute trading 5. Treat confirmation as single-use: after one execution, request confirmation again for any next order Required confirmation fields:

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/gate-runtime-rules.md (reported line 16)May include surrounding context.
md
## 1. MCP Session and Authentication - Use the already configured Gate MCP session for the current host. - Local Gate MCP deployments use `GATE_API_KEY` and `GATE_API_SECRET`; never ask the user to paste these secrets into chat. - Minimal permissions for this skill are `Spot:Write` and `Wallet:Read`. - If the required Gate MCP tools are missing, stop write actions and switch to setup guidance only. - If the MCP session returns an auth or permission error, stop write actions and guide the user to repair the configured local MCP credentials before continuing.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/scenarios.md (reported line 43)May include surrounding context.
md
3. Output `Limit Order Draft` and then `Open Order/Execution Report` after confirmation. **Unexpected Behavior**: 1. Converts to market order and executes immediately even though user asked for limit price. 2. Returns "open order created" without checking whether quote balance can support order value. 3. Uses wrong price precision and returns exchange error without a user-readable fix suggestion. ## Scenario 3: Buy with All USDT

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/scenarios.md (reported line 274)May include surrounding context.
md
3. Output `Limit Order Draft` and then `Open Order/Execution Report` after confirmation. **Unexpected Behavior**: 1. Converts to market order and executes immediately even though user asked for limit price. 2. Returns "open order created" without checking whether quote balance can support order value. 3. Uses wrong price precision and returns exchange error without a user-readable fix suggestion. ## Scenario 3: Buy with All USDT

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/scenarios.md (reported line 181)May include surrounding context.
md
3. Output `Downside-Exit Draft` and then `Execution/Open-Order Report` after confirmation. **Unexpected Behavior**: 1. Claims native TP/SL trigger support and submits unsupported order semantics. 2. Executes sell without confirmation under "risk-control urgency" wording. 3. Computes 5% drop from wrong anchor (entry price vs current price) without disclosure. ## Scenario 13: Buy Top 24h Gainer

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown includes a Chinese prompt example alongside English instructions, and similar Chinese-only examples recur later. Because the document does not state that the skill is region-specific or that users may choose their preferred language, it implicitly supports or expects a specific locale without explicit opt-in, which can conflict with language-choice policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file embeds Chinese prompt examples for this scenario but does not clarify whether the skill should respond in the user's chosen language or whether Chinese support is merely illustrative. Without an explicit language-choice statement, the skill guidance risks violating organizational policy on forced or assumed locale behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This scenario includes a Chinese example, but the surrounding document never explains language selection behavior. That omission can create ambiguity about whether the skill assumes or enforces a locale, which is a natural-language policy concern under the language-choice rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The scenario provides a Chinese prompt example but does not define whether the skill is intended for a Chinese-speaking region or whether language choice is user-controlled. That missing policy clarification can be interpreted as an unsupported locale assumption.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: A Chinese example is included here, yet the document contains no instruction that the assistant should adapt to the user's preferred language. This can be a policy violation where language or locale handling must be explicitly optional or justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file contains conflicting natural-language guidance around TP/SL support: one section says TP/SL-style requests are handled via trigger-order tools, while another later says TP/SL is not supported. This inconsistency can mislead both users and the agent, causing incorrect expectations or unsafe fallback behavior during order placement.
Content: No source excerpt is available for this finding.