Security audit

Gate Claude Code One-Click Installer (MCP + Skills)

Security checks for vulnerabilities and agentic risk

Overview

This installer is not clearly malicious, but it makes persistent Claude changes, installs mutable remote code, and can store trading credentials in plaintext.

Install only if you trust Gate's remote services and the live GitHub/npm sources at install time. Prefer `--no-skills` or explicit `--mcp` selections, avoid entering trading API secrets unless necessary, use narrowly scoped/read-only keys where possible, back up `~/.claude.json` and `~/.claude/skills/`, and review the exact cloned skills and package versions before use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:12
Finding: Mutable External Instructions Can Hijack Agent Policy and Tool Selection
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: scripts/install.sh:176
Finding: Unverified Remote Skills Are Installed into Persistent Agent State
Content: View full analysis
/dev/null || mktemp -d -t gate-skills) trap "rm -rf '$TMP_CLONE'" EXIT if command -v git &>/dev/null; then git clone --depth 1 -b "$GATE_SKILLS_BRANCH" "$GATE_SKILLS_REPO" "$TMP_CLONE" else echo "git is required to clone gate-skills. Please install git or use --no-skills to install MCP only." >&2 exit 1 fi mkdir -p "$SKILLS_DIR" SKILLS_SRC="$TMP_CLONE/skills" if [[ ! -d "$SKILLS_SRC" ]]; then echo "skills directory not found in the gate-skills repository" >&2 exit 1 fi for dir in "$SKILLS_SRC"/*; do [[ -d "$dir" ]] || continue name=$(basename "$dir") dst="$SKILLS_DIR/$name" if [[ -d "$dst" ]]; then rm -rf "$dst" fi cp -R "$dir" "$dst" echo " Installed skill: $name" done echo "Skills installed to: $SKILLS_DIR" ``` ### Technical Analysis The installer clones a mutable branch without pinning a commit, verifying a signed release, or validating file hashes. The selected branch can also be changed through the inherited `GATE_SKILLS_BRANCH` environment variable. All directories under the downloaded repository’s `skills/` directory are copied into `~/.claude/skills/`. Existing same-named Skills are deleted first. Because Skill files contain instructions that affect future agent behavior, this operation installs an unaudited remote instruction payload into persistent agent state and can replace previously trusted Skills. The use of HTTPS protects transport but does not ensure that the repository’s current contents are the same contents that were audited. ### Attack Path 1. An attacker compromises the upstream repos ...[truncated 1112 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/install.sh:87
Finding: Unpinned npm Components Are Automatically Installed and Executed
Content: View full analysis
/dev/null; then echo "npx not found, attempting to install: npm install -g npx ..." if npm install -g npx 2>/dev/null; then echo "npx installed successfully." else echo "Error: npx not found, and automatic installation failed." >&2 echo "Please run manually: npm install -g npx" >&2 exit 1 fi fi ``` ```json { "Gate": { "command": "npx", "args": ["-y", "gate-mcp"], "env": { "GATE_API_KEY": "your-api-key", "GATE_API_SECRET": "your-api-secret" } } } ``` ### Technical Analysis The installer globally installs `npx` without specifying a version or integrity value. It also configures Claude to invoke `npx -y gate-mcp`, which resolves an unversioned package and automatically accepts installation prompts. This means the executable code may differ between installations and may change after the Skill is reviewed. A compromised npm maintainer account, registry package, or future malicious release could result in arbitrary package lifecycle or runtime code executing on the user’s system. The global `npm install -g npx` operation also modifies the user’s global tool environment even though the installer’s primary purpose is to configure Claude. ### Attack Path 1. An attacker compromises the `npx` or `gate-mcp` package, its publisher account, or a future release. 2. The user runs the installer or starts the configured Gate MCP server. 3. npm resolves the latest unpinned package version. 4. The `-y` option suppresses interactive confirmation for `gate-mcp`. 5. npm downloads and executes package lifecycle or runtime code. 6. The malicious package executes with the privileges and environment of the current user. ### Impact Assessment A maliciou ...[truncated 402 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/merge-mcp-config.js:47
Finding: Trading API Credentials Are Persisted in Plaintext Configuration
Content: View full analysis
&2 USER_GATE_API_KEY="" fi fi fi ``` ```bash unset GATE_USER_API_KEY GATE_USER_API_SECRET 2>/dev/null || true if [[ -n "$USER_GATE_API_KEY" ]]; then export GATE_USER_API_KEY="$USER_GATE_API_KEY" export GATE_USER_API_SECRET="$USER_GATE_API_SECRET" fi node "$MERGE_JS" "$TMP_JSON" "$CLAUDE_JSON" "${FRAGS[@]}" unset GATE_USER_API_KEY GATE_USER_API_SECRET 2>/dev/null || true rm -f "$TMP_JSON" ``` ```javascript if (add.Gate && add.Gate.env && process.env.GATE_USER_API_KEY) { add.Gate.env.GATE_API_KEY = process.env.GATE_USER_API_KEY; add.Gate.env.GATE_API_SECRET = process.env.GATE_USER_API_SECRET || ''; } const existing = readExisting(existingPath); existing.mcpServers = existing.mcpServers || {}; Object.assign(existing.mcpServers, add); fs.writeFileSync(outPath, JSON.stringify(existing, null, 2)); ``` ### Technical Analysis The secret is hidden during terminal input, but it is subsequently exported to the merger process and serialized directly into `~/.claude.json`. The code does not use an operating-system credential store, encrypted secret file, or ...[truncated 1429 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/merge-mcp-config.js:9
Finding: Malformed or Unreadable Existing Configuration Is Silently Overwritten
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (43)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The top-level description understates the true behavior of the skill: it is not merely informational installation guidance but a persistent config modifier that installs multiple remote services and introduces credential/OAuth flows. This mismatch reduces informed consent and can cause users to approve broad, security-relevant changes they did not realize were included.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
md
- `SKILL.md` keeps product scope, install behavior, and user-facing guidance.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: A hard-coded API key is embedded directly in the configuration file, which means anyone with access to the skill source or installed artifact can recover and reuse it. Exposed credentials can enable unauthorized access, abuse of the remote MCP service, billing impact, and make key rotation difficult if the secret is widely distributed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The README instructs users to run npx -y gate-mcp without pinning a package version, which means installation will always fetch the latest published package. If the upstream npm package is compromised, typo-squatted, or a malicious version is published, users could execute attacker-controlled code during installation or runtime.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This component description again advertises npx -y gate-mcp without a pinned version, creating the same supply-chain exposure for users following the documented setup. Because this skill is specifically an installer, unpinned execution is more dangerous than a casual reference: it directly influences how users launch privileged local tooling.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill performs sensitive installer actions, including modifying persistent Claude configuration and handling environment-based credentials, but it declares no explicit tool scope or permissions boundary. In a skill ecosystem, that makes the effective authority ambiguous and increases the chance the agent uses broader capabilities than the user expects during installation.
Content: No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
Content: Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.
md
## General Rules ⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding. Do NOT select or call any tool until all rules are read. These rules have the highest priority. → Read [gate-runtime-rules.md](https://github.com/gate/gate-skills/blob/master/skills/gate-runtime-rules.md) - **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they exist in the MCP server.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: Using npx -y gate-mcp without pinning a version causes the installer to fetch and execute whatever package version is current at runtime. That creates a supply-chain risk where a malicious, compromised, or breaking upstream release can be installed automatically and granted MCP execution privileges.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The resource definition again specifies npx -y gate-mcp without an exact version, so the resulting local MCP command is non-deterministic and can change over time. Because MCP servers may access user data and credentials, executing an unpinned package meaningfully raises supply-chain compromise risk.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: This resource definition includes a fixed x-api-key plus bearer-token authorization for a remote DEX endpoint, indicating the installer will configure authenticated outbound access to an external service. Embedding and distributing a shared static API key in skill content is risky because it normalizes secret-in-config patterns and can expose or misuse a credential across many installations.
Content: Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.
md
| MCP | **Gate** (Local CEX, `main`) | stdio `npx -y gate-mcp`, env `GATE_API_KEY` / `GATE_API_SECRET` — [gate-mcp](https://github.com/gate/gate-mcp) | | MCP | **gate-cex-pub** (`cex-public`) | `https://api.gatemcp.ai/mcp`, HTTP, `type`+`url` only (no headers), no auth | | MCP | **gate-cex-ex** (`cex-exchange`) | `https://api.gatemcp.ai/mcp/exchange`, HTTP, `type`+`url` only; Gate OAuth2 on first use | | MCP | **Gate-Dex** (`dex`) | `https://api.gatemcp.ai/mcp/dex`, fixed `x-api-key` + `Authorization: Bearer ${GATE_MCP_TOKEN}` | | MCP | **Gate-Info** (`info`) | `https://api.gatemcp.ai/mcp/info` | | MCP | **Gate-News** (`news`) | `https://api.gatemcp.ai/mcp/news` | | Skills | gate-skills | https://github.com/gate/gate-skills (installs all under `skills/`) |

Session Persistence

Medium

Category: Rogue Agent
Confidence: 87% confidence
Finding: The skill explicitly writes to user-level Claude configuration, creating persistent changes that survive the current session and alter future tool behavior. Persistent configuration of multiple MCP servers is security-relevant because it broadens future trust boundaries and can silently affect later sessions if the user forgets the change was made.
Content: Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.
md
- If the user does not specify which MCPs → install all: `main`, `cex-public`, `cex-exchange`, `dex`, `info`, `news`. - If the user specifies "only install xxx" → install only the specified MCPs. ### 2. Write Claude Code MCP Config - User-level config: `~/.claude.json` (Windows: `%USERPROFILE%\.claude.json`). If using directory format, use the corresponding config under `~/.claude/`. - If it already exists, **merge** into the existing `mcpServers`; do not overwrite other MCPs.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The install instructions do not provide an upfront warning that running the installer will persistently modify ~/.claude.json and copy content into ~/.claude/skills/. For an installer skill, lack of front-loaded disclosure is a safety issue because users may not realize the scope and persistence of the changes before execution.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: The skill instructs pulling all subdirectories from a remote repository and copying them into the active Claude skills directory, effectively importing a large, changing set of executable skill content. Bulk installation of unreviewed remote skills expands the trusted code base and creates a broad supply-chain and privilege-escalation surface.
Content: Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.
md
### 3. Install gate-skills (all) - Pull all subdirectories under **skills/** from https://github.com/gate/gate-skills and copy them to `~/.claude/skills/` (or the corresponding directory for the current environment). - Add `--no-skills` when using the script to install MCP only without skills. ### 4. Post-Installation Prompt

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/mcp.md (reported line 71)May include surrounding context.
md
1. Never overwrite unrelated existing MCP config blocks. 2. If merge conflicts occur, stop and provide manual remediation. 3. Do not claim successful install without verification. 4. Keep secrets out of logs and user-visible output.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 5)May include surrounding context.
md
# Gate Claude Code One-Click Installer: MCP + all gate-skills # Usage: install.sh [--mcp main|cex-public|cex-exchange|dex|info|news] ... [--no-skills] # main = Local stdio gate-mcp (GATE_API_KEY / GATE_API_SECRET) # cex-public = Remote https://api.gatemcp.ai/mcp (public market data, no auth) # cex-exchange = Remote https://api.gatemcp.ai/mcp/exchange (CEX private tools, Gate OAuth2) # Installs all MCPs when no --mcp is passed. DEX uses fixed x-api-key: MCP_AK_8W2N7Q

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 37)May include surrounding context.
md
# Gate Claude Code One-Click Installer: MCP + all gate-skills # Usage: install.sh [--mcp main|cex-public|cex-exchange|dex|info|news] ... [--no-skills] # main = Local stdio gate-mcp (GATE_API_KEY / GATE_API_SECRET) # cex-public = Remote https://api.gatemcp.ai/mcp (public market data, no auth) # cex-exchange = Remote https://api.gatemcp.ai/mcp/exchange (CEX private tools, Gate OAuth2) # Installs all MCPs when no --mcp is passed. DEX uses fixed x-api-key: MCP_AK_8W2N7Q

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 38)May include surrounding context.
md
# Gate Claude Code One-Click Installer: MCP + all gate-skills # Usage: install.sh [--mcp main|cex-public|cex-exchange|dex|info|news] ... [--no-skills] # main = Local stdio gate-mcp (GATE_API_KEY / GATE_API_SECRET) # cex-public = Remote https://api.gatemcp.ai/mcp (public market data, no auth) # cex-exchange = Remote https://api.gatemcp.ai/mcp/exchange (CEX private tools, Gate OAuth2) # Installs all MCPs when no --mcp is passed. DEX uses fixed x-api-key: MCP_AK_8W2N7Q

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 39)May include surrounding context.
md
# Gate Claude Code One-Click Installer: MCP + all gate-skills # Usage: install.sh [--mcp main|cex-public|cex-exchange|dex|info|news] ... [--no-skills] # main = Local stdio gate-mcp (GATE_API_KEY / GATE_API_SECRET) # cex-public = Remote https://api.gatemcp.ai/mcp (public market data, no auth) # cex-exchange = Remote https://api.gatemcp.ai/mcp/exchange (CEX private tools, Gate OAuth2) # Installs all MCPs when no --mcp is passed. DEX uses fixed x-api-key: MCP_AK_8W2N7Q

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 40)May include surrounding context.
md
# Gate Claude Code One-Click Installer: MCP + all gate-skills # Usage: install.sh [--mcp main|cex-public|cex-exchange|dex|info|news] ... [--no-skills] # main = Local stdio gate-mcp (GATE_API_KEY / GATE_API_SECRET) # cex-public = Remote https://api.gatemcp.ai/mcp (public market data, no auth) # cex-exchange = Remote https://api.gatemcp.ai/mcp/exchange (CEX private tools, Gate OAuth2) # Installs all MCPs when no --mcp is passed. DEX uses fixed x-api-key: MCP_AK_8W2N7Q

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 41)May include surrounding context.
md
# Gate Claude Code One-Click Installer: MCP + all gate-skills # Usage: install.sh [--mcp main|cex-public|cex-exchange|dex|info|news] ... [--no-skills] # main = Local stdio gate-mcp (GATE_API_KEY / GATE_API_SECRET) # cex-public = Remote https://api.gatemcp.ai/mcp (public market data, no auth) # cex-exchange = Remote https://api.gatemcp.ai/mcp/exchange (CEX private tools, Gate OAuth2) # Installs all MCPs when no --mcp is passed. DEX uses fixed x-api-key: MCP_AK_8W2N7Q

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
md
# Gate Claude Code One-Click Installer: MCP + all gate-skills # Usage: install.sh [--mcp main|cex-public|cex-exchange|dex|info|news] ... [--no-skills] # main = Local stdio gate-mcp (GATE_API_KEY / GATE_API_SECRET) # cex-public = Remote https://api.gatemcp.ai/mcp (public market data, no auth) # cex-exchange = Remote https://api.gatemcp.ai/mcp/exchange (CEX private tools, Gate OAuth2) # Installs all MCPs when no --mcp is passed. DEX uses fixed x-api-key: MCP_AK_8W2N7Q

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.
md
# Gate Claude Code One-Click Installer: MCP + all gate-skills # Usage: install.sh [--mcp main|cex-public|cex-exchange|dex|info|news] ... [--no-skills] # main = Local stdio gate-mcp (GATE_API_KEY / GATE_API_SECRET) # cex-public = Remote https://api.gatemcp.ai/mcp (public market data, no auth) # cex-exchange = Remote https://api.gatemcp.ai/mcp/exchange (CEX private tools, Gate OAuth2) # Installs all MCPs when no --mcp is passed. DEX uses fixed x-api-key: MCP_AK_8W2N7Q

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
md
# Gate Claude Code One-Click Installer: MCP + all gate-skills # Usage: install.sh [--mcp main|cex-public|cex-exchange|dex|info|news] ... [--no-skills] # main = Local stdio gate-mcp (GATE_API_KEY / GATE_API_SECRET) # cex-public = Remote https://api.gatemcp.ai/mcp (public market data, no auth) # cex-exchange = Remote https://api.gatemcp.ai/mcp/exchange (CEX private tools, Gate OAuth2) # Installs all MCPs when no --mcp is passed. DEX uses fixed x-api-key: MCP_AK_8W2N7Q

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
md
# Gate Claude Code One-Click Installer: MCP + all gate-skills # Usage: install.sh [--mcp main|cex-public|cex-exchange|dex|info|news] ... [--no-skills] # main = Local stdio gate-mcp (GATE_API_KEY / GATE_API_SECRET) # cex-public = Remote https://api.gatemcp.ai/mcp (public market data, no auth) # cex-exchange = Remote https://api.gatemcp.ai/mcp/exchange (CEX private tools, Gate OAuth2) # Installs all MCPs when no --mcp is passed. DEX uses fixed x-api-key: MCP_AK_8W2N7Q

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.
md
# Gate Claude Code One-Click Installer: MCP + all gate-skills # Usage: install.sh [--mcp main|cex-public|cex-exchange|dex|info|news] ... [--no-skills] # main = Local stdio gate-mcp (GATE_API_KEY / GATE_API_SECRET) # cex-public = Remote https://api.gatemcp.ai/mcp (public market data, no auth) # cex-exchange = Remote https://api.gatemcp.ai/mcp/exchange (CEX private tools, Gate OAuth2) # Installs all MCPs when no --mcp is passed. DEX uses fixed x-api-key: MCP_AK_8W2N7Q

Static analysis

No suspicious patterns detected.