Security audit

Gate Exchange TradFi Query Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real Gate TradFi query-and-trading integration, but it needs Review because the README says it is read-only while the actual skill can place, amend, cancel, modify, and close trades with write permissions.

Review this carefully before installing. Treat it as a write-enabled Gate TradFi trading skill, not a read-only query helper. Only use it with credentials whose trading permissions you intentionally want to grant, verify every confirmation prompt before approving an order or position change, and prefer a separate read-only key if you only need account or market queries. The publisher should update the README and bundle or pin the shared runtime rules before this is considered low-risk.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:12
Finding: Mutable External Instructions Are Assigned Highest Priority
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: README.md:1
Finding: README Misrepresents a Write-Enabled Trading Skill as Read-Only
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.
md
- `SKILL.md` keeps routing and domain constraints.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
Content: Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.
md
## General Rules ⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding. Do NOT select or call any tool until all rules are read. These rules have the highest priority. → Read [gate-runtime-rules.md](https://github.com/gate/gate-skills/blob/master/skills/gate-runtime-rules.md) - **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they exist in the MCP server.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list includes very broad verbs such as 'buy', 'sell', 'cancel', and 'close', which can cause this trading skill to activate for unrelated user requests. In a financial trading context, incorrect routing is risky because it can expose account data or steer the session toward trade execution flows when the user did not intend to interact with TradFi at all.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.
md
### 2. Read sub-module and call tools - Load the corresponding reference under `references/` and follow its Workflow. - **Query**: Call query tools with extracted/prompted parameters; no confirmation needed. - **Trading**: Build the parameter set per the reference and MCP; **output parameters for user confirmation**; only after user confirms, call the trading MCP tool; then **in the response, explain the parameters used and the outcome**. ### 3. Report

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.
md
## Error Handling | Situation | Action | | -------------------------- | ------------------------------------------------------------------------------------------------------- | | Tool not found / 4xx/5xx | Tell user the TradFi service or tool may be unavailable; suggest retry or check Gate MCP configuration. | | Empty list | Report "No open orders" / "No positions" / "No symbols" etc., and do not assume error. |

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.
md
## Safety Rules - **Query**: No confirmation required; display data after tool success. - **Trading**: **Always** output parameters for user confirmation before calling place/amend/cancel/modify/close; **never** execute a write operation without explicit user confirmation. After execution, **always** explain in the response the parameters that were used and the outcome. - **Sensitive data**: Do not log or store credentials or balances; display only in the current response.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger examples include short, generic phrases such as 'Change take-profit to 1.08' that may match user utterances without clearly anchoring to a specific existing TradFi position. In a trading skill, overly broad activation can cause the agent to enter a position-modification workflow in response to ambiguous conversational text, increasing the chance of unintended trade-related actions or confusing prompts for confirmation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The stop-loss examples are especially ambiguous because phrases like 'Modify position stop-loss 1.03' or 'Change stop-loss to 1.03' omit a clear asset or account context. In a financial trading environment, this can misroute ordinary discussion into a live order-modification flow, potentially leading to changes on the wrong position if the system attempts to resolve context from prior state.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The example triggers "Balance" and "How much do I have" are overly broad and can match many unrelated user intents, causing the TradFi skill to activate outside its intended scope. In a financial context, this misrouting can expose account balances or MT5 data when the user meant something non-financial, creating an avoidable privacy and data-minimization risk.
Content: No source excerpt is available for this finding.

Unbounded Resource Access

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
Content: Scanner excerpt · references/query-assets.md (reported line 64)May include surrounding context.
md
1. Call `cex_tradfi_query_user_assets`. 2. Format as assets table (asset, available, locked, total). 3. If error or empty, reply "Unable to load assets" and do not retry indefinitely. 4. Do not expose API keys or secrets; only display balance data returned by the tool. ---

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This markdown file states "All content in English," which is a natural-language locale constraint. Under the policy, forcing a specific language without offering the user a choice or documenting a justified regional need is a violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The example prompts include generic phrases such as "Order history," "My positions," and "Balance," which are broad enough to overlap with ordinary conversation or requests in other financial contexts. The README does not provide exclusion conditions or clear constraints describing when these phrases should or should not invoke this specific skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The trigger example "My TradFi balance" is too generic for a workflow that is supposed to handle a specific-asset query. This can cause the agent to select the one-asset scenario when the user actually wants a full balance overview, leading to incorrect tool usage or incomplete financial disclosure handling.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.