T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:11- Finding
Mutable External Instructions Are Declared to Have Highest Priority
- Content
View full analysis
- Remediation
View remediation
Security audit
Gate Exchange Sub-Account
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its Gate sub-account purpose, but it relies on a changeable external rules file for a financial account workflow, so it needs review before use.
Review this before installing. The local workflow is narrow and requires confirmation for create, lock, and unlock actions, but only use it if you trust the external Gate MCP setup and verify or vendor the referenced runtime rules. Avoid exposing API keys, and do not let raw API errors be shown directly to end users.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/mcp.md:73- Finding
Verbatim API Error Disclosure Conflicts with Sensitive-Trace Handling Rules
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `SKILL.md` keeps intent routing and permission boundaries.
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
- Content
md ## General Rules ⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding. Do NOT select or call any tool until all rules are read. These rules have the highest priority. → Read [gate-runtime-rules.md](https://github.com/gate/gate-skills/blob/master/skills/gate-runtime-rules.md) - **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they exist in the MCP server.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Safety Rules - **Write operations** (`cex_sa_create_sa`, `cex_sa_lock_sa`, `cex_sa_unlock_sa`): Always require explicit user confirmation before execution. Never auto-execute. - **UID validation**: Before lock/unlock, always verify the sub-account exists and belongs to the current main account. - **State check**: Before lock/unlock, check current state to avoid redundant operations. - **No sensitive data exposure**: Never expose API keys, internal endpoint URLs, or raw error traces.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The create-sub-account trigger examples are broad enough to match ordinary conversational requests such as 'Help me set up a new sub-account', which can cause the skill to activate in ambiguous contexts and initiate an account-management flow with side effects. In a financial exchange setting, accidental routing into a creation workflow is more dangerous because it can lead to unintended account provisioning unless the agent applies strict intent disambiguation and confirmation before any tool call.
- Content