ClawHub
Back to skill

Security audit

Gate Codex One-Click Installer (MCP + Skills)

Security checks for vulnerabilities and agentic risk

Overview

This installer mostly matches its stated purpose, but it persistently changes Codex, fetches unpinned remote skills and packages, and can store trading credentials in plaintext, so it needs review before installation.

Review the exact config changes before running this. Prefer explicit --mcp selections and --no-skills unless you intentionally want the full remote skill bundle. Do not enter Gate trading credentials unless you are comfortable with them being stored in Codex config; use least-privilege API keys, avoid withdrawal permissions, restrict by IP where possible, and rotate keys after any exposure.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:12
Finding

Mutable Remote Rules Are Declared as Highest-Priority Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-15
Vulnerability Type: Remote instruction hijacking
Risk Level: High

Vulnerable Code

markdown
⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding.
Do NOT select or call any tool until all rules are read. These rules have the highest priority.
→ Read [gate-runtime-rules.md](https://github.com/gate/gate-skills/blob/master/skills/gate-runtime-rules.md)
- **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they

Technical Analysis

The skill delegates control of its runtime instructions to a file hosted on a mutable GitHub branch and explicitly represents those remote instructions as having the “highest priority.” The effective instructions can therefore change after this package has been reviewed.

If the remote repository or an authorized maintainer account is compromised, the referenced document could be modified to introduce prompt-injection instructions, redirect the current task, request sensitive information, invoke inappropriate tools, or suppress security controls. The package contains no commit pin, content hash, signature check, or bundled reviewed copy of the referenced rules.

Attack Path

  1. An attacker compromises the remote repository, its maintainer account, or the mutable master branch.
  2. The attacker modifies gate-runtime-rules.md to contain hostile agent instructions.
  3. A user invokes this installer skill.
  4. The skill directs the agent to retrieve and treat the modified rules as highest-priority instructions.
  5. The hostile rules alter the agent’s current goals, tool selection, output, or handling of sensitive data.

Impact Assessment

Exploitation can influence the active agent session within the tools and permissions already available to the agent. Potential consequences include task redirection, unauthorize ...[truncated 231 chars]

Remediation
View remediation

Remediation Suggestions

  • Bundle the reviewed runtime rules inside the skill package.
  • Remove language claiming that externally hosted content has higher priority than system, developer, or user instructions.
  • If remote retrieval is unavoidable, pin the URL to an immutable Git commit and verify an expected cryptographic digest before use.
  • Treat retrieved documents as untrusted reference material rather than executable agent instructions.
  • Establish a review and release process in which changes to runtime rules require a new audited package version.

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/install.sh:241
Finding

Unpinned Remote Skills Are Downloaded and Persistently Replace Local Skills

Content
View full analysis

Vulnerability Details

File Location: scripts/install.sh, lines 11-12 and 241-268
Vulnerability Type: Mutable remote payload retrieval and persistent instruction installation
Risk Level: High

Vulnerable Code

bash
GATE_SKILLS_REPO="https://github.com/gate/gate-skills.git"
GATE_SKILLS_BRANCH="${GATE_SKILLS_BRANCH:-master}"
bash
if command -v git &>/dev/null; then
  git clone --depth 1 -b "$GATE_SKILLS_BRANCH" "$GATE_SKILLS_REPO" "$TMP_CLONE"
else
  echo "git is required to clone gate-skills. Please install git or use --no-skills to install MCP only." >&2
  exit 1
fi

mkdir -p "$SKILLS_DIR"
SKILLS_SRC="$TMP_CLONE/skills"
if [[ ! -d "$SKILLS_SRC" ]]; then
  echo "skills directory not found in the gate-skills repository" >&2
  exit 1
fi

for dir in "$SKILLS_SRC"/*; do
  [[ -d "$dir" ]] || continue
  name=$(basename "$dir")
  dst="$SKILLS_DIR/$name"
  if [[ -d "$dst" ]]; then
    rm -rf "$dst"
  fi
  cp -R "$dir" "$dst"
  echo "  Installed skill: $name"
done

Technical Analysis

The installer clones the mutable master branch of an external repository without pinning a commit, verifying a signature, or checking file hashes. It then copies every directory under the remote skills/ directory into persistent Codex storage.

When a same-named destination already exists, the script recursively deletes it before installing the downloaded replacement. Consequently, remotely controlled instructions or scripts can silently replace previously reviewed local skills and remain active after Codex restarts.

Although HTTPS protects transport in ordinary circumstances, it does not protect against repository compromise, malicious authorized commits, account takeover, or an unsafe branch selected through GATE_SKILLS_BRANCH.

Attack Path

  1. An attacker gains the ability to modify the configured repository or selected branch.
  2. The attacke ...[truncated 880 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the repository to a reviewed immutable commit rather than master.
  • Publish and verify a signed manifest containing the expected paths and SHA-256 hashes.
  • Reject arbitrary GATE_SKILLS_BRANCH overrides unless the selected revision passes the same verification process.
  • Maintain an explicit allowlist of skill directories and files instead of copying every remote directory.
  • Present the revision and planned file changes to the user before installation.
  • Back up existing skills and require confirmation before replacement; do not silently run rm -rf on existing installations.
  • Stage downloaded content in a non-active directory, validate it, and atomically activate it only after successful verification.

T08 · Insecure Dependencies

Error
Location
scripts/install.sh:91
Finding

Unpinned npm Packages Can Execute Automatically

Content
View full analysis

Vulnerability Details

File Location: scripts/install.sh, lines 91-99 and 165-166; scripts/mcp-fragments/codex/gate-main-npx-placeholder.toml, lines 2-5
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

Vulnerable Code

bash
if ! command -v npx &>/dev/null; then
  echo "npx not found, attempting to install: npm install -g npx ..."
  if npm install -g npx 2>/dev/null; then
    echo "npx installed successfully."
  else
    echo "Error: npx not found, and automatic installation failed." >&2
    echo "Please run manually: npm install -g npx" >&2
    exit 1
  fi
fi
bash
command = "npx"
args = ["-y", "gate-mcp"]

The generated configuration contains the same unpinned invocation:

toml
[mcp_servers.Gate]
command = "npx"
args = ["-y", "gate-mcp"]
env = { GATE_API_KEY = "your-api-key", GATE_API_SECRET = "your-api-secret" }

Technical Analysis

npm install -g npx resolves an unspecified package version and may run npm lifecycle scripts during installation. The generated MCP configuration also executes npx -y gate-mcp without an exact version or integrity constraint. The -y option suppresses interactive confirmation.

This makes future execution dependent on whatever package version the registry resolves at that time. A compromised publisher account, malicious release, registry compromise, or dependency-chain compromise could introduce arbitrary code after this installer has been audited.

Attack Path

  1. An attacker compromises the npx or gate-mcp publication process, or one of their transitive dependencies.
  2. A malicious version is published under the expected package name.
  3. The installer runs the unpinned global installation, or Codex starts the configured npx -y gate-mcp command.
  4. npm resolves and downloads the malicious version.
  5. Lifecycle or runtime code executes with the p ...[truncated 508 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not install a separate global npx package automatically; require a supported Node.js distribution that already provides the necessary package runner.
  • Pin gate-mcp to an exact reviewed version, such as gate-mcp@X.Y.Z.
  • Verify package integrity using a lockfile, expected npm integrity digest, or a signed release artifact.
  • Avoid -y for first-time installation and show the resolved package version to the user.
  • Prefer a locally installed, lockfile-controlled dependency over dynamic registry resolution on every MCP startup.
  • Audit and pin transitive dependencies as part of the release process.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/install.sh:107
Finding

Gate Trading Credentials Are Written to Plaintext Configuration Without Permission Hardening

Content
View full analysis

Vulnerability Details

File Location: scripts/install.sh, lines 107-119 and 147-168
Vulnerability Type: Plaintext sensitive-data storage and unsafe configuration interpolation
Risk Level: High

Vulnerable Code

bash
USER_GATE_API_KEY=""
USER_GATE_API_SECRET=""
if [[ $MCP_MAIN -eq 1 ]]; then
  echo ""
  echo "Gate (main) spot/futures trading requires an API Key to operate your account."
  echo "Visit the link below to create an API Key (enable spot/futures trading permissions):"
  echo "  https://www.gate.com/myaccount/profile/api-key/manage"
  echo ""
  read -p "  GATE_API_KEY (leave empty to skip): " USER_GATE_API_KEY
  if [[ -n "$USER_GATE_API_KEY" ]]; then
    read -s -p "  GATE_API_SECRET: " USER_GATE_API_SECRET
    echo ""
    if [[ -z "$USER_GATE_API_SECRET" ]]; then
      echo "Warning: GATE_API_SECRET is empty; spot/futures trading will not work." >&2
      USER_GATE_API_KEY=""
    fi
  fi
fi
bash
cat >> "$CONFIG_TOML" << TOML

[mcp_servers.Gate]
command = "gate-mcp"
args = []
env = { GATE_API_KEY = "$USER_GATE_API_KEY", GATE_API_SECRET = "$USER_GATE_API_SECRET" }
TOML
bash
cat >> "$CONFIG_TOML" << TOML

[mcp_servers.Gate]
command = "npx"
args = ["-y", "gate-mcp"]
env = { GATE_API_KEY = "$USER_GATE_API_KEY", GATE_API_SECRET = "$USER_GATE_API_SECRET" }
TOML

Technical Analysis

The secret is hidden while typed, but it is subsequently stored directly in $CODEX_HOME/config.toml. The script does not enforce restrictive directory or file permissions, use an operating-system secret store, or check whether an existing configuration is readable by other users.

The values are also interpolated directly into TOML without serialization or escaping. A credential containing TOML-significant characters, particularly quotes or backslashes, can corrupt the configuration or alter the resulting inline table. ...[truncated 1182 chars]

Remediation
View remediation

Remediation Suggestions

  • Store API credentials in an operating-system credential manager or another dedicated secret store.
  • Where secret-store integration is unavailable, reference environment variables rather than embedding their values in TOML.
  • Create $CODEX_HOME with mode 0700 and enforce mode 0600 on config.toml; verify and correct permissions on existing files before writing secrets.
  • Use a TOML-aware library to parse, merge, escape, and serialize configuration values.
  • Avoid encouraging broad trading permissions; document least-privilege API-key scopes and recommend IP restrictions where supported.
  • Warn users that credentials must never include withdrawal permissions unless explicitly necessary.
  • Provide credential rotation and removal instructions in case the configuration file is exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (38)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · README.md (reported line 46)May include surrounding context.

md
## Config File Locations

- **MCP config**: `~/.codex/config.toml` (or `$CODEX_HOME/config.toml`), merged with care (append-only for Gate tables).
- **Skills**: `$CODEX_HOME/skills/` (default `~/.codex/skills/`).

## Dependencies

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill presents itself as a simple installer, but its documented behavior goes much further: it modifies persistent Codex configuration, installs multiple remote MCP endpoints by default, copies an entire external skills repository into the user's home directory, and contemplates storing API credentials in local config. That mismatch reduces informed consent and increases the chance a user triggers broad system and account-affecting changes they did not reasonably expect from the description alone.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
- `SKILL.md` keeps product scope, install behavior, and user-facing guidance.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
96% confidence
Finding

This skill is explicitly designed to write to the agent's persistent configuration at ~/.codex/config.toml, which can alter future MCP behavior across sessions. In context, this is more dangerous because the modification is not narrowly scoped to a temporary install check; it establishes durable trust relationships and endpoints, including remote services and optional credentials.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md
### 2. Write Codex MCP Config

- User-level config: `~/.codex/config.toml` (or `$CODEX_HOME/config.toml`). Creates the file and writes `[mcp_servers]` with corresponding tables if it does not exist.
- If it already exists, **merge**: only append Gate MCP sections that don't already exist; do not overwrite existing config.
- Config details:
  - **Gate (main)**: stdio, `command` / `args` / optional `env` for `GATE_API_KEY` / `GATE_API_SECRET`

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Embedding a fixed DEX API key into every user's Codex configuration is an unjustified credential injection mechanism and creates a shared-secret anti-pattern. It can enable unauthorized use, make activity attributable to a common embedded key, and conditions users to accept silent credential seeding by installer content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The installation section presents the script as 'one-click' but does not clearly warn that it will modify Codex configuration and install skills/components onto the local system. This reduces informed consent and can cause users or agents to run a system-modifying installer without understanding its side effects.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The README instructs users to execute npx -y gate-mcp without pinning a specific package version or integrity constraint. This allows installation of whatever version is current at execution time, increasing supply-chain risk if the package is compromised, replaced, or updated with breaking or unsafe behavior.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
## General Rules

⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding.
Do NOT select or call any tool until all rules are read. These rules have the highest priority.
→ Read [gate-runtime-rules.md](https://github.com/gate/gate-skills/blob/master/skills/gate-runtime-rules.md)
- **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they
  exist in the MCP server.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill claims to install Gate MCP or skills, but its default behavior expands this into cloning and installing all Gate skills from an external repository plus all MCP variants. That broad default materially increases the attack surface by pulling unpinned remote content and persisting it locally without requiring a narrowly scoped user request.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

The installer intentionally creates durable session persistence by writing MCP server entries into Codex config so they load in future sessions. In this context, persistence is security-relevant because it silently extends trust in remote endpoints and installed skills beyond the original installation moment.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md
- If the user does not specify which MCPs → install all: `main`, `cex-public`, `cex-exchange`, `dex`, `info`, `news`.
- If the user specifies "only install xxx" → install only the specified MCPs.

### 2. Write Codex MCP Config

- User-level config: `~/.codex/config.toml` (or `$CODEX_HOME/config.toml`). Creates the file and writes `[mcp_servers]` with corresponding tables if it does not exist.
- If it already exists, **merge**: only append Gate MCP sections that don't already exist; do not overwrite existing config.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented workflow writes to ~/.codex/config.toml and copies content into the user's home directory, but the skill does not foreground these persistent side effects as a clear upfront warning. This makes the installer more dangerous in context because it changes agent behavior across future sessions, not just the current task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill mentions optional environment values for Gate API credentials and DEX auth-related headers, but it does not clearly warn users that auth material may be written into local configuration or otherwise persisted. Omitting that warning undermines informed consent around secret handling and increases the chance sensitive values are stored insecurely.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
89% confidence
Finding

The skill instructs pulling all subdirectories from an external skills/ repository and copying them into $CODEX_HOME/skills/, effectively enumerating and importing a broad set of capabilities into the agent environment. That enlarges the future execution surface and trust boundary without limiting installation to the user's immediate need.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md
### 3. Install gate-skills (all)

- Pull all subdirectories under **skills/** from https://github.com/gate/gate-skills and copy them to `$CODEX_HOME/skills/` (default `~/.codex/skills/`).
- Add `--no-skills` when using the script to install MCP only without skills.

### 4. Post-Installation Prompt

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The post-installation instruction tells the agent to inform the user using a fixed English phrase: "all gate-skills have been installed." This imposes a specific language in user-facing output without opt-in, which is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script defaults to cloning and installing all skills from a remote repository unless '--no-skills' is specified, which is broader than the narrowly described task of adding Gate MCP or skills on request. Pulling and installing a whole remote skill set by default materially increases attack surface and trusts mutable remote content at install time.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The installer performs 'npm install -g npx', which modifies the user's global runtime environment beyond merely configuring Codex. Global package installation increases blast radius and can introduce supply-chain risk or require elevated privileges, especially if users run the installer with sudo.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

When the user supplies API credentials, the script writes them directly into '~/.codex/config.toml' in plaintext. Persisting trading credentials without an explicit storage warning or safer secret-handling mechanism risks credential theft via local compromise, backups, logs, or accidental file disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 37)May include surrounding context.

md
[mcp_servers.gate-news]
url = "https://api.gatemcp.ai/mcp/news"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 38)May include surrounding context.

md
[mcp_servers.gate-news]
url = "https://api.gatemcp.ai/mcp/news"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

md
[mcp_servers.gate-news]
url = "https://api.gatemcp.ai/mcp/news"

Static analysis

No suspicious patterns detected.