gate-info-riskcheck

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:04 AM UTC
• Version: 1.0.3

Overview

The skill appears to be a read-only Gate Info helper for token and contract risk reports, with some ambiguous triggers and a limited address mode but no artifact-backed unsafe behavior.

Install this only if you are comfortable using Gate-Info MCP for read-only token, contract, and public address lookups. Treat reports as automated risk signals, not investment advice; address-risk mode is limited and should not be relied on for complete blacklist or compliance screening.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: This markdown changelog includes a trigger list with phrases such as "is this token safe" and "is this address safe," which overlap with common user language and do not define when the skill should or should not activate. The entry provides no negative examples or limiting context, increasing the risk of unintended invocation.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The README presents invocation examples like "Is this token safe", "Check 0x... contract on eth", and "Is this address safe" without narrowing context or listing exclusions. These phrases are generic enough that normal conversation about tokens or addresses could unintentionally match the skill's routing conditions.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

## General Rules

⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding.
Do NOT select or call any tool until all rules are read. These rules have the highest priority.
→ Read `../gate-runtime-rules.md`
→ Also read `../info-news-runtime-rules.md` for gate-info / gate-news shared rules (tool degradation, report standards, security, routing, and optional local maintenance when `scripts/` is present).
- **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they

• Confidence: 80% confidence
• Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The overview states that 'Address compliance checking will be added in a future phase,' implying the skill does not currently include that capability. Elsewhere, the documented tools include `info_compliance_check_address_risk` and routing/execution sections present an Address Risk mode, even if degraded or unavailable. This creates an internal contradiction about whether address-risk checking is part of the current skill behavior.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The manifest says this skill should be used only when the query is exclusively about token/contract/address security and that multi-dimension analysis belongs in gate-info-research. However, the workflow explicitly fetches `info_coin_get_coin_info` and tells the LLM to combine security detection data with fundamentals, adding project name, sector, and exchange listing context to the output. That behavior goes beyond a narrowly scoped security-only assessment.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The tool invocation template specifies `lang="en"`, which forces English-language output regardless of the user's preferred language or locale. This is a natural-language policy concern because the skill does not indicate any user choice, opt-in, or justified locale restriction.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The examples "Is this token safe" and "Is PEPE safe" are underspecified and can cause the agent to route a broad safety question into a narrowly scoped token-risk workflow before the user has clarified chain or even the asset type. In this skill's context, ambiguous routing matters because the metadata says this skill must only be used for exclusive token/contract/address security queries, so vague examples increase the chance of misclassification and incomplete or misleading security output.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The address-risk examples "Is this address safe 0x..." and "Is this a blacklisted address" are broad enough to overlap with wallet reputation, sanctions, scam exposure, or general investigation requests that this skill explicitly cannot fully satisfy. Because the scenario only supports degraded-mode basic address info, these triggers may over-route users into a limited workflow and produce a false sense of safety from incomplete checks.

Static analysis

No suspicious patterns detected.