Gate VIP & Fee Query Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:25 AM UTC
• Version: 1.0.2

Overview

The skill is read-only and mostly matches its Gate VIP/fee purpose, but it relies on mutable external runtime instructions and may read account details even for fee-only requests.

Review before installing. Use a Gate credential limited to Account:Read and Wallet:Read with no trading or withdrawal permissions, and be aware that the skill's current instructions may fetch account details during setup/detection and depend on external runtime rules that can change outside this package.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:10
• Finding: Mutable External Instructions Are Assigned Highest Runtime Priority< - **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they ``` ### Technical Analysis The Skill requires the Agent to retrieve instructions from a mutable external GitHub document and declares those rules to have the “highest priority.” The effective runtime instructions are therefore not fully contained in the audited package. Because the URL references a repository branch rather than an immutable, integrity-verified revision, its contents can change after this Skill has been reviewed. A repository owner or attacker who compromises the remote source could insert instructions that alter the Agent’s goals, safety constraints, tool-selection behavior, or response handling. Declaring externally supplied text to have the highest priority is also an explicit instruction-precedence manipulation. Skill content must not claim precedence over system, developer, platform, or user safety requirements. ### Attack Path 1. A user invokes the Gate VIP and fee query Skill. 2. The Skill blocks normal processing until the Agent reads the externally hosted runtime rules. 3. An attacker modifies the document on the referenced GitHub branch, or compromises the repository or publishing workflow. 4. The Agent retrieves the modified Markdown after the Skill was audited. 5. The Skill directs the Agent to treat the retrieved content as highest-priority instructions. 6. The malicious rules influence subsequent authenticated MCP calls, data handling, ...[truncated 845 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Copy the complete runtime rules into the audited Skill package and reference the local, version-controlled file. 2. Remove language claiming that Skill or remotely retrieved instructions have the “highest priority.” 3. Explicitly state that system, developer, platform, and user safety requirements take precedence over Skill instructions. 4. If remote retrieval is unavoidable, pin the resource to an immutable commit and verify its cryptographic digest before use. 5. Treat remotely retrieved documentation as untrusted data rather than executable Agent instructions. 6. Include all effective runtime rules in security reviews and release them under the same version as the Skill. 7. Enforce tool and permission restrictions in the MCP host rather than relying solely on natural-language instructions. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/mcp.md:18
• Finding: Fee-Only Requests Trigger an Unnecessary Authenticated Account-Detail Probe<![CDATA[ ## Vulnerability Details **File Location**: `references/mcp.md`, lines 18–21 **Vulnerability Type**: T05: Unauthorized Access and Privilege Escalation **Risk Level**: Medium ### Vulnerable Code ```markdown Detection: 1. Verify Gate MCP exposes `cex_account_get_account_detail` and `cex_wallet_get_wallet_fee`. 2. Probe with account detail query. ``` ### Technical Analysis The MCP detection procedure requires an authenticated `cex_account_get_account_detail` query regardless of the user’s requested operation. Consequently, a fee-only request can cause account-profile information to be retrieved even though only `cex_wallet_get_wallet_fee` is necessary. This violates least-privilege and data-minimization principles. It also conflicts with the same document’s execution requirement to call only the minimal required read tools. Tool availability should be established through MCP capability discovery or metadata inspection, not by issuing a user-data query. Although the operation is read-only, authorization to read account details does not mean that every invocation should access them. Access must remain purpose-bound to the user’s request. ### Attack Path 1. A user asks only for spot or futures trading fees. 2. The Skill begins MCP availability detection. 3. The detection procedure invokes `cex_account_get_account_detail`. 4. Gate authenticates the call using the configured API key. 5. Account-profile context is retrieved despite being unrelated to the fee-only request. 6. The Skill then invokes the fee tool and returns the requested fee information. ### Impact Assessment The issue causes unnecessary access to authenticated Gate account-profile data. Its scope is limited by the documented read-only `Account:Read` permission, so it does not directly enable trading or account modification. Potential effects include: - Unnecessary exposure of VIP or account-profile context to the Agent and MCP processing chain. - Increased sensitive-data handling a ...[truncated 301 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the mandatory account-detail probe from MCP detection. 2. Use MCP capability discovery, tool enumeration, or schema metadata to verify tool availability without accessing user data. 3. Invoke `cex_account_get_account_detail` only when the classified request is a VIP-tier or combined VIP-and-fee query. 4. For fee-only requests, call only `cex_wallet_get_wallet_fee`. 5. Enforce purpose-based tool authorization in the MCP host so account-detail access is denied when it is not required by the selected workflow. 6. Avoid retaining or logging account-detail responses obtained during health checks. 7. Add tests confirming that spot-only, futures-only, and general fee requests never invoke the account-detail tool. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Ae1

High

• Category: analysis-evasion

Content

- `SKILL.md` keeps intent routing and rendering rules.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

## General Rules

⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding.
Do NOT select or call any tool until all rules are read. These rules have the highest priority.
→ Read [gate-runtime-rules.md](https://github.com/gate/gate-skills/blob/master/skills/gate-runtime-rules.md)
- **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they
  exist in the MCP server.

• Confidence: 80% confidence
• Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Static analysis

No suspicious patterns detected.