Gate Cursor One-Click Installer (MCP + Skills)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:42 PM UTC
• Version: 1.0.2

Overview

The installer has a legitimate Gate setup purpose, but it makes broad persistent Cursor changes and pulls mutable remote code/instructions without enough safeguards.

Review before installing. Prefer selecting only the MCPs you need and using --no-skills unless you intend to install all Gate skills. Do not enter high-privilege trading API keys unless you accept plaintext storage in Cursor config; use limited, IP-restricted keys where possible. Pin or review the exact gate-mcp version and gate-skills commit before running the installer.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:12
• Finding: Mutable External Instructions Are Granted Highest Priority< - **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they exist in the MCP server. ``` ### Technical Analysis The Skill instructs the Agent to fetch a document from an external GitHub URL and treat its contents as rules with the “highest priority.” The URL references the mutable `master` branch rather than an immutable commit. Consequently, the effective instructions executed by the Agent are not limited to the locally audited package. The external document can change after publication or review, allowing repository maintainers—or an attacker who compromises the upstream repository—to modify the Agent's objectives, safety constraints, or tool-use policy without changing this Skill. External content must never be allowed to supersede system, developer, platform-security, or user instructions. Treating remotely retrieved text as authoritative instructions creates a direct instruction-hijacking channel. ### Attack Path 1. An attacker compromises the upstream `gate/gate-skills` repository or obtains permission to modify the referenced runtime-rules file. 2. The attacker adds instructions that request secrets, redirect operations, invoke dangerous tools, or suppress safety checks. 3. A user loads or invokes this installer Skill. 4. The Skill orders the Agent to retrieve the mutable external document. 5. The Agent treats the attacker-controlled rules as having the highest priority. 6. The malicious instructions alter the current A ...[truncated 622 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bundle the complete runtime rules inside the audited package and reference them through a local relative path. 2. If remote retrieval is unavoidable, pin the URL to an immutable Git commit and verify the downloaded content against a maintained cryptographic hash or signature. 3. Remove language claiming that Skill-provided or remotely retrieved rules have the “highest priority.” 4. Explicitly state that Skill instructions remain subordinate to system, developer, platform-security, and user instructions. 5. Treat remotely retrieved text as untrusted reference material rather than executable Agent instructions. 6. Include any required runtime-rules file in the same security review and release artifact as the Skill. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install.sh:168
• Finding: Unpinned Remote Skills and npm Executable Create a Mutable Supply-Chain Execution Path<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install.sh:11-12, 124-129, 168-197`; `scripts/mcp-fragments/cursor/gate-main-npx.json:1-10` **Vulnerability Type**: Unverified remote payload installation and execution **Risk Level**: High ### Vulnerable Code ```bash GATE_SKILLS_REPO="https://github.com/gate/gate-skills.git" GATE_SKILLS_BRANCH="${GATE_SKILLS_BRANCH:-master}" ``` ```bash if [[ $MCP_MAIN -eq 1 ]] && command -v gate-mcp &>/dev/null; then GATE_MAIN_CMD="gate-mcp" FRAGS+=("$FRAG_DIR/gate-main-gate-mcp.json") elif [[ $MCP_MAIN -eq 1 ]]; then GATE_MAIN_CMD="npx" FRAGS+=("$FRAG_DIR/gate-main-npx.json") fi ``` ```bash if [[ $INSTALL_SKILLS -eq 0 ]]; then echo "Skipped gate-skills installation (--no-skills)." else echo "Installing gate-skills (all)..." TMP_CLONE=$(mktemp -d 2>/dev/null || mktemp -d -t gate-skills) trap "rm -rf '$TMP_CLONE'" EXIT if command -v git &>/dev/null; then git clone --depth 1 -b "$GATE_SKILLS_BRANCH" "$GATE_SKILLS_REPO" "$TMP_CLONE" else echo "git is required to clone gate-skills. Please install git or use --no-skills to install MCP only." >&2 exit 1 fi mkdir -p "$SKILLS_DIR" SKILLS_SRC="$TMP_CLONE/skills" if [[ ! -d "$SKILLS_SRC" ]]; then echo "skills directory not found in the gate-skills repository" >&2 exit 1 fi for dir in "$SKILLS_SRC"/*; do [[ -d "$dir" ]] || continue name=$(basename "$dir") dst="$SKILLS_DIR/$name" if [[ -d "$dst" ]]; then rm -rf "$dst" fi cp -R "$dir" "$dst" echo " Installed skill: $name" done fi ``` ```json { "Gate": { "command": "npx", "args": ["-y", "gate-mcp"], "env": { "GATE_API_KEY": "your-api-key", "GATE_API_SECRET": "your-api-secret" } } } ``` ### Technical Analysis The default installation clones the mutable `master` branch of a remote repository and copies every directory under its `skills/` directory into Cursor's persistent user-level skills directory. ...[truncated 2293 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the Git dependency to a reviewed immutable commit rather than `master`. 2. Verify the cloned commit against an expected commit ID and, preferably, a signed release. 3. Pin `gate-mcp` to an exact reviewed version, such as `gate-mcp@x.y.z`. 4. Use npm lockfile integrity data, package signatures, or a trusted internal artifact mirror. 5. Avoid `npx -y` for security-sensitive executables; require explicit user confirmation before downloading or updating code. 6. Display the precise list and versions of Skills before installation and request confirmation. 7. Install only the minimum Skills selected by the user instead of all upstream directories by default. 8. Back up existing same-named Skills and require explicit consent before replacing them. 9. Stage downloaded content in a quarantine directory, validate its structure and policy compliance, and only then perform an atomic installation. 10. Document the update mechanism and require a new security review whenever the pinned dependency versions change. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/merge-mcp-config.js:9
• Finding: Malformed Existing Cursor Configuration Is Silently Replaced<![CDATA[ ## Vulnerability Details **File Location**: `scripts/merge-mcp-config.js:9-15, 52-55` **Vulnerability Type**: Unsafe error handling and destructive configuration write **Risk Level**: High ### Vulnerable Code ```javascript function readExisting(path) { try { const raw = fs.readFileSync(path, 'utf8'); if (!raw.trim()) return {}; return JSON.parse(raw); } catch { return {}; } } ``` ```javascript const existing = readExisting(existingPath); existing.mcpServers = existing.mcpServers || {}; Object.assign(existing.mcpServers, add); fs.writeFileSync(outPath, JSON.stringify(existing, null, 2)); ``` ### Technical Analysis The merge helper handles every read or JSON parsing failure by returning an empty object. It does not distinguish between: - A legitimately absent or empty configuration. - Invalid JSON. - Permission failures. - Input/output errors. - Unexpected filesystem behavior. After substituting `{}`, the helper writes the generated Gate configuration directly over the real `mcp.json`. As a result, an existing configuration that cannot be parsed or read is treated as if it contained no data. This behavior directly contradicts the documented rule in `references/mcp.md:68-70` to preserve unrelated MCP blocks and abort on malformed JSON. The write is also not transactional: there is no validated backup, atomic rename, or rollback if the output is incomplete or interrupted. ### Attack Path 1. The user's existing `mcp.json` contains malformed JSON, has a transient read problem, or otherwise causes `readFileSync` or `JSON.parse` to fail. 2. The catch block silently returns an empty object. 3. The installer adds only the selected Gate MCP entries to that empty object. 4. `writeFileSync` overwrites the original Cursor configuration. 5. Existing non-Gate MCP definitions and other top-level configuration fields are lost. An attacker with limited ability to corrupt the configuration before installation could intentionally trigger ...[truncated 593 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat a missing file separately from a read or parse failure. 2. Abort with a clear error when existing JSON is malformed; never substitute an empty object for invalid existing data. 3. Validate that the parsed root value is a non-null JSON object and that `mcpServers`, when present, is also an object. 4. Create a timestamped backup with owner-only permissions before modifying the configuration. 5. Write the merged content to a temporary file in the same directory. 6. Set restrictive permissions, parse the temporary output again, and verify that unrelated entries remain present. 7. Atomically rename the validated temporary file over the original. 8. Preserve the original file and provide recovery instructions if any operation fails. 9. Add regression tests covering malformed JSON, unreadable files, unexpected root types, interrupted writes, and preservation of unrelated MCP entries. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/install.sh:96
• Finding: Trading API Credentials Are Stored in Plaintext Without Enforced File Permissions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install.sh:96-113, 139-151`; `scripts/merge-mcp-config.js:47-55` **Vulnerability Type**: Insecure credential storage and handling **Risk Level**: Medium ### Vulnerable Code ```bash USER_GATE_API_KEY="" USER_GATE_API_SECRET="" if [[ $MCP_MAIN -eq 1 ]]; then echo "" echo "Gate (main) spot/futures trading requires an API Key to operate your account." echo "Visit the link below to create an API Key (enable spot/futures trading permissions):" echo " https://www.gate.com/myaccount/profile/api-key/manage" echo "" read -p " GATE_API_KEY (leave empty to skip): " USER_GATE_API_KEY if [[ -n "$USER_GATE_API_KEY" ]]; then read -s -p " GATE_API_SECRET: " USER_GATE_API_SECRET echo "" if [[ -z "$USER_GATE_API_SECRET" ]]; then echo "Warning: GATE_API_SECRET is empty; spot/futures trading will not work." >&2 USER_GATE_API_KEY="" fi fi fi ``` ```bash if command -v node &>/dev/null; then EXISTING="{}" [[ -f "$MCP_JSON" ]] && EXISTING=$(cat "$MCP_JSON") TMP_JSON=$(mktemp) echo "$EXISTING" > "$TMP_JSON" unset GATE_USER_API_KEY GATE_USER_API_SECRET 2>/dev/null || true if [[ -n "$USER_GATE_API_KEY" ]]; then export GATE_USER_API_KEY="$USER_GATE_API_KEY" export GATE_USER_API_SECRET="$USER_GATE_API_SECRET" fi node "$MERGE_JS" "$TMP_JSON" "$MCP_JSON" "${FRAGS[@]}" unset GATE_USER_API_KEY GATE_USER_API_SECRET 2>/dev/null || true rm -f "$TMP_JSON" fi ``` ```javascript if (add.Gate && add.Gate.env && process.env.GATE_USER_API_KEY) { add.Gate.env.GATE_API_KEY = process.env.GATE_USER_API_KEY; add.Gate.env.GATE_API_SECRET = process.env.GATE_USER_API_SECRET || ''; } const existing = readExisting(existingPath); existing.mcpServers = existing.mcpServers || {}; Object.assign(existing.mcpServers, add); fs.writeFileSync(outPath, JSON.stringify(existing, null, 2)); ``` ### Technical Analysis The installer requests API credentials that may have spot and f ...[truncated 2464 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer an operating-system credential manager, encrypted secret store, or supported Cursor secret-reference mechanism instead of embedding credentials in JSON. 2. Make credential entry an explicit optional post-install step and clearly disclose that credentials will otherwise be stored in plaintext. 3. If file storage is unavoidable, set `umask 077` before creating temporary or configuration files. 4. Create and maintain `mcp.json` with mode `0600`, verify that it is owned by the intended user, and refuse to proceed when ownership is unsafe. 5. Write atomically through a restrictive temporary file in the same directory. 6. Avoid exporting secrets as environment variables where a direct protected input channel is available. 7. Clear shell variables as soon as they are no longer required, while acknowledging that this does not replace secure storage. 8. Recommend dedicated least-privilege API keys, IP allowlisting, short rotation periods, and disabling withdrawal permissions. 9. Never print real credential values in logs, errors, verification output, or backups. 10. Provide documented credential revocation and rotation procedures. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/mcp-fragments/cursor/gate-dex.json:1
• Finding: Shared Hardcoded DEX Access Key Is Distributed to Every Installation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/mcp-fragments/cursor/gate-dex.json:1-10`; `SKILL.md:108` **Vulnerability Type**: Hardcoded shared credential-like value **Risk Level**: Low ### Vulnerable Code ```json { "Gate-Dex": { "url": "https://api.gatemcp.ai/mcp/dex", "transport": "streamable-http", "headers": { "x-api-key": "MCP_AK_8W2N7Q", "Authorization": "Bearer ${GATE_MCP_TOKEN}" } } } ``` ```markdown - The DEX x-api-key is fixed as `MCP_AK_8W2N7Q` and written to mcp.json. ``` ### Technical Analysis A fixed value labeled as an `x-api-key` is embedded in the distributed package and written into every user's MCP configuration. Because the value is available to anyone who can download the project, it cannot provide confidential per-user authentication. If the server treats this value as an authorization credential, it can be copied and used outside the intended client. A single shared value also prevents reliable attribution between installations and creates a common revocation point. Abuse by one party could consume shared quotas or cause the key to be blocked for all users. The separate Bearer token placeholder indicates that user-specific authorization may be expected elsewhere, which may limit the authority of the fixed key. Nevertheless, the security role of the fixed `x-api-key` is not clearly constrained in the package. ### Attack Path 1. An attacker downloads or inspects the public package. 2. The attacker extracts `MCP_AK_8W2N7Q`. 3. The attacker sends requests to the DEX endpoint using the shared `x-api-key`. 4. If the service grants access, routing priority, or quota based on that value, the attacker consumes or abuses those capabilities. 5. The provider may revoke or rate-limit the shared key, disrupting every legitimate installation that uses it. ### Impact Assessment Potential impact includes unauthorized endpoint use, quota theft, degraded attribution, abuse-related blocking, and se ...[truncated 339 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not distribute a shared value if the server treats it as a secret or authorization credential. 2. Provision per-user, revocable, and preferably short-lived credentials through an authenticated enrollment flow. 3. Store user-specific credentials in a protected secret store rather than directly in the JSON fragment. 4. Apply per-user and per-client rate limits so abuse does not affect every installation. 5. If the value is intentionally public and provides no authorization, rename it to a non-secret client identifier and document that it must not be relied upon as a security boundary. 6. Rotate the current value if it was ever intended to remain confidential. 7. Document the exact privileges provided by the `x-api-key` separately from the user-specific Bearer token. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (32)

Ae1

High

• Category: analysis-evasion

Content

- `SKILL.md` keeps product scope, install behavior, and user-facing guidance.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Natural-Language Policy Violations

High

• Confidence: 99% confidence
• Finding: The configuration hard-codes an API key directly into a distributed JSON file, which exposes the credential to anyone who can read the repository, package, logs, or installation artifacts. Even if this key is intended to be low-privilege or public-ish, embedding credentials in code enables unauthorized reuse, complicates rotation, and can grant access to MCP services under the publisher's account or trust boundary.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The README instructs users to run `npx -y gate-mcp` without pinning a specific package version. That causes installation of whatever version is current at execution time, creating a supply-chain risk where a compromised package release or unexpected breaking change could be pulled and then executed locally. In the context of an installer skill for trading tools, this is more dangerous because users are being guided to install software that may later handle API keys, OAuth flows, or trading-related actions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The component table again advertises `npx -y gate-mcp` without a pinned version, repeating the same supply-chain exposure. Users may treat the table as authoritative installation guidance, so this expands the likelihood that an unreviewed future package version is executed. Because this skill installs MCP tooling for a developer assistant environment, compromise could affect local systems and any connected exchange credentials.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill appears to require code-capable actions such as editing local configuration and handling environment-related setup, but it does not declare an explicit tool scope or permissions boundary. That omission weakens least-privilege controls and makes it easier for an agent/runtime to perform broader actions than the user may expect during installation.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

## General Rules

⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding.
Do NOT select or call any tool until all rules are read. These rules have the highest priority.
→ Read [gate-runtime-rules.md](https://github.com/gate/gate-skills/blob/master/skills/gate-runtime-rules.md)
- **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they
  exist in the MCP server.

• Confidence: 80% confidence
• Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: Using `npx -y gate-mcp` without pinning a specific version causes execution of whatever package version is current at install time. This creates a supply-chain risk: a compromised, malicious, or simply breaking upstream release could be installed and executed on the user's machine.

Session Persistence

Medium

• Category: Rogue Agent

Content

- If the user does not specify which MCPs → install all: `main`, `cex-public`, `cex-exchange`, `dex`, `info`, `news`.
- If the user specifies "only install xxx" → install only the specified MCPs.

### 2. Write Cursor MCP Config

- Config file: `~/.cursor/mcp.json` (Windows: `%APPDATA%\Cursor\mcp.json`).
- If it already exists, **merge** into the existing `mcpServers`; do not overwrite other MCPs.

• Confidence: 92% confidence
• Finding: Writing and merging entries into `~/.cursor/mcp.json` creates persistent session-level changes that survive beyond the current interaction. Because the skill defaults to installing multiple MCP servers, this persistence expands the future trust surface and may affect later sessions in ways the user did not explicitly review.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs modification of `~/.cursor/mcp.json` but does not prominently warn the user that local configuration will be changed and persisted. Silent or weakly disclosed config mutation can surprise users, alter future agent behavior, and create an unsafe precedent for persistent trust changes.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Copying all subdirectories from a remote repository into `~/.cursor/skills/` performs broad local file installation without an explicit safety notice or per-item review. This increases the chance of introducing unreviewed skills that may later run with agent privileges or influence future sessions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The one-click installer command is presented as a simple `bash` invocation without clearly stating that it will modify persistent configuration and install local files. Users may execute it without understanding the extent of changes, which is especially risky when the script is sourced from a repository and may perform network-dependent actions.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. Never overwrite unrelated MCP server blocks.
2. Abort and explain on malformed JSON or merge conflict.
3. Do not claim success without verification.
4. Mask secrets in user-visible output.

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script advertises a fixed DEX API key embedded for all users, which is inappropriate for a local installer and can route usage through a shared credential outside the user's control. Shared hardcoded credentials undermine attribution, may expose users to unauthorized third-party access patterns, and create revocation or abuse risk if the key is compromised or rate-limited.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The installer unconditionally deletes any existing destination skill directory and replaces it, which can destroy locally modified content or overwrite previously trusted versions without user consent. In a security-sensitive toolchain, silent replacement also makes downgrade or malicious-content substitution easier if the upstream repository or selected branch is compromised.

External Transmission

Medium

• Category: Data Exfiltration

Content

{
  "Gate-News": {
    "url": "https://api.gatemcp.ai/mcp/news",
    "transport": "streamable-http"
  }
}

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

{
  "Gate-News": {
    "url": "https://api.gatemcp.ai/mcp/news",
    "transport": "streamable-http"
  }
}

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

{
  "Gate-News": {
    "url": "https://api.gatemcp.ai/mcp/news",
    "transport": "streamable-http"
  }
}

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

{
  "Gate-News": {
    "url": "https://api.gatemcp.ai/mcp/news",
    "transport": "streamable-http"
  }
}

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

{
  "Gate-News": {
    "url": "https://api.gatemcp.ai/mcp/news",
    "transport": "streamable-http"
  }
}

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

{
  "Gate-News": {
    "url": "https://api.gatemcp.ai/mcp/news",
    "transport": "streamable-http"
  }
}

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.