Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `SKILL.md` keeps user-type routing, task-display semantics, and policy constraints.
Security audit
gate-exchange-welfare
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed read-only Gate welfare helper, but its broad triggers can cause authenticated financial account checks for generic reward or task questions.
Install only if you want an agent to use your configured Gate MCP credentials to check welfare eligibility and beginner task status. Prefer tightening activation to explicit Gate welfare or new-user reward requests so ordinary questions about tasks, rewards, deposits, or trading do not trigger account-specific checks.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (20)
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
Expected Behavior:
- Call
cex_welfare_get_user_identity(user type determination interface), return result: code=1008 (not logged in). - Output prompt text:
text Please log in to your Gate account first before querying welfare tasks.- Call
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
Expected Behavior:
- Call
cex_welfare_get_user_identity(user type determination interface), return result: code=1008 (not logged in). - Output prompt text:
text Please log in to your Gate account first before querying welfare tasks.- Call
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
Expected Behavior:
- Call
cex_welfare_get_user_identity(user type determination interface), return result: code=1008 (not logged in). - Output prompt text:
text Please log in to your Gate account first before querying welfare tasks.- Call
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
Expected Behavior:
- Call
cex_welfare_get_user_identity(user type determination interface), return result: code=1008 (not logged in). - Output prompt text:
text Please log in to your Gate account first before querying welfare tasks.- Call
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
Expected Behavior:
- Call
cex_welfare_get_user_identity(user type determination interface), return result: code=1008 (not logged in). - Output prompt text:
text Please log in to your Gate account first before querying welfare tasks.- Call
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
Expected Behavior:
- Call
cex_welfare_get_user_identity(user type determination interface), return result: code=1008 (not logged in). - Output prompt text:
text Please log in to your Gate account first before querying welfare tasks.- Call
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file records trigger phrases such as "what welfare" and "how to claim rewards," which are generic enough to match ordinary conversation outside a narrowly defined skill context. The entry does not provide scope limits, exclusion conditions, or negative examples to clarify when the skill should or should not activate.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file states that documentation, templates, safety rules, and instructions were converted to English and describes the skill as using English-only documentation. This is a natural-language locale policy constraint, and the changelog provides no indication that users can choose another language or that the restriction is region-specific and justified.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger language is broad enough that ordinary questions about rewards, benefits, or tasks could invoke this skill when the user may have intended a different product area. That can cause incorrect routing, unnecessary identity/tool calls, and leakage of misleading account-state guidance, especially in a multi-skill financial assistant where reward/task concepts overlap.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The routing rule 'Query welfare / rewards / tasks' is overly vague and may capture a large set of unrelated intents across the exchange, including campaign rewards, task completion help, or asset-related questions. In this context, overbroad routing is risky because the skill performs identity-based branching and may suppress more appropriate specialized skills, degrading correctness and potentially exposing user-state-specific responses unnecessarily.
- Content
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
- Content
md ## General Rules ⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding. Do NOT select or call any tool until all rules are read. These rules have the highest priority. → Read `./references/gate-runtime-rules.md` - **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they exist in the MCP server.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Credentials Source: Local Gate MCP deployment (`GATE_API_KEY`, `GATE_API_SECRET`) - API Key Required: Yes - Permissions: Welfare:Read - Never ask the user to paste secrets into chat; rely on the configured MCP session only. - API Key Provisioning Reference: https://www.gate.com/myaccount/profile/api-key/manage (create or rotate keys outside the chat when the local MCP setup requires them). ### Installation Check
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger scenario uses broad reward-related language such as 'benefits', 'rewards', and 'task claiming' without strong domain constraints, so the skill can be invoked for loosely related conversations. In an agentic system, over-broad activation increases the chance of misrouting users into a credentialed financial workflow and causing unnecessary identity checks or disclosure of account-specific information.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The routing table includes generic keywords like 'rewards' and 'welfare' that are common across many unrelated contexts. This can cause accidental skill selection, leading the agent to access authenticated welfare endpoints for users who did not intend a Gate-specific account query, which is a security and privacy boundary issue.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## 1. MCP Session and Authentication - Use the already configured Gate MCP session for the current host. - Local Gate MCP deployments use `GATE_API_KEY` and `GATE_API_SECRET`; never ask the user to paste these secrets into chat. - Minimal permission for this skill is `Welfare:Read`. - If the required Gate MCP tools are missing, stop and switch to setup guidance only. - If the MCP session returns an auth or permission error, stop and guide the user to repair the configured local MCP credentials before continuing.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger examples "What tasks can I do" and "Task list" are overly broad for a welfare-specific skill and can match many unrelated user intents. In an agent router, this can cause unintended activation of the welfare skill, leading to wrong tool calls, incorrect guidance, and misrouting away from the user’s intended workflow.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Cross-skill routing examples like "How to deposit" and "I want to deposit" are generic deposit intents, not welfare-specific intents. If used as triggers in routing logic, they can hijack normal funding requests and incorrectly force users through the welfare skill path, causing confusion and unsafe or unintended tool orchestration.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Examples such as "How to trade" and "I want to buy coins" are broad, standard exchange intents that overlap with ordinary spot trading usage. In a multi-skill environment, this creates prompt/route collision risk where a welfare skill may intercept core trading requests and misdirect the user or trigger incorrect downstream behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The sample user-facing response hardcodes English phrasing such as task labels, reward text, and warning text, with no indication that the skill supports user language preference. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content