ClawHub
Back to skill

Security audit

Gate Cursor One-Click Installer (MCP + Skills)

Security checks for vulnerabilities and agentic risk

Overview

The installer has a legitimate Gate setup purpose, but it makes broad persistent Cursor changes and pulls mutable remote code/instructions without enough safeguards.

Review before installing. Prefer selecting only the MCPs you need and using --no-skills unless you intend to install all Gate skills. Do not enter high-privilege trading API keys unless you accept plaintext storage in Cursor config; use limited, IP-restricted keys where possible. Pin or review the exact gate-mcp version and gate-skills commit before running the installer.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:12
Finding

Mutable External Instructions Are Granted Highest Priority

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/install.sh:168
Finding

Unpinned Remote Skills and npm Executable Create a Mutable Supply-Chain Execution Path

Content
View full analysis
/dev/null; then GATE_MAIN_CMD="gate-mcp" FRAGS+=("$FRAG_DIR/gate-main-gate-mcp.json") elif [[ $MCP_MAIN -eq 1 ]]; then GATE_MAIN_CMD="npx" FRAGS+=("$FRAG_DIR/gate-main-npx.json") fi ``` ```bash if [[ $INSTALL_SKILLS -eq 0 ]]; then echo "Skipped gate-skills installation (--no-skills)." else echo "Installing gate-skills (all)..." TMP_CLONE=$(mktemp -d 2>/dev/null || mktemp -d -t gate-skills) trap "rm -rf '$TMP_CLONE'" EXIT if command -v git &>/dev/null; then git clone --depth 1 -b "$GATE_SKILLS_BRANCH" "$GATE_SKILLS_REPO" "$TMP_CLONE" else echo "git is required to clone gate-skills. Please install git or use --no-skills to install MCP only." >&2 exit 1 fi mkdir -p "$SKILLS_DIR" SKILLS_SRC="$TMP_CLONE/skills" if [[ ! -d "$SKILLS_SRC" ]]; then echo "skills directory not found in the gate-skills repository" >&2 exit 1 fi for dir in "$SKILLS_SRC"/*; do [[ -d "$dir" ]] || continue name=$(basename "$dir") dst="$SKILLS_DIR/$name" if [[ -d "$dst" ]]; then rm -rf "$dst" fi cp -R "$dir" "$dst" echo " Installed skill: $name" done fi ``` ```json { "Gate": { "command": "npx", "args": ["-y", "gate-mcp"], "env": { "GATE_API_KEY": "your-api-key", "GATE_API_SECRET": "your-api-secret" } } } ``` ### Technical Analysis The default installation clones the mutable `master` branch of a remote repository and copies every directory under its `skills/` directory into Cursor's persistent user-level skills directory. ...[truncated 2293 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/merge-mcp-config.js:9
Finding

Malformed Existing Cursor Configuration Is Silently Replaced

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/install.sh:96
Finding

Trading API Credentials Are Stored in Plaintext Without Enforced File Permissions

Content
View full analysis
&2 USER_GATE_API_KEY="" fi fi fi ``` ```bash if command -v node &>/dev/null; then EXISTING="{}" [[ -f "$MCP_JSON" ]] && EXISTING=$(cat "$MCP_JSON") TMP_JSON=$(mktemp) echo "$EXISTING" > "$TMP_JSON" unset GATE_USER_API_KEY GATE_USER_API_SECRET 2>/dev/null || true if [[ -n "$USER_GATE_API_KEY" ]]; then export GATE_USER_API_KEY="$USER_GATE_API_KEY" export GATE_USER_API_SECRET="$USER_GATE_API_SECRET" fi node "$MERGE_JS" "$TMP_JSON" "$MCP_JSON" "${FRAGS[@]}" unset GATE_USER_API_KEY GATE_USER_API_SECRET 2>/dev/null || true rm -f "$TMP_JSON" fi ``` ```javascript if (add.Gate && add.Gate.env && process.env.GATE_USER_API_KEY) { add.Gate.env.GATE_API_KEY = process.env.GATE_USER_API_KEY; add.Gate.env.GATE_API_SECRET = process.env.GATE_USER_API_SECRET || ''; } const existing = readExisting(existingPath); existing.mcpServers = existing.mcpServers || {}; Object.assign(existing.mcpServers, add); fs.writeFileSync(outPath, JSON.stringify(existing, null, 2)); ``` ### Technical Analysis The installer requests API credentials that may have spot and f ...[truncated 2464 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/mcp-fragments/cursor/gate-dex.json:1
Finding

Shared Hardcoded DEX Access Key Is Distributed to Every Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (32)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
- `SKILL.md` keeps product scope, install behavior, and user-facing guidance.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The configuration hard-codes an API key directly into a distributed JSON file, which exposes the credential to anyone who can read the repository, package, logs, or installation artifacts. Even if this key is intended to be low-privilege or public-ish, embedding credentials in code enables unauthorized reuse, complicates rotation, and can grant access to MCP services under the publisher's account or trust boundary.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The README instructs users to run npx -y gate-mcp without pinning a specific package version. That causes installation of whatever version is current at execution time, creating a supply-chain risk where a compromised package release or unexpected breaking change could be pulled and then executed locally. In the context of an installer skill for trading tools, this is more dangerous because users are being guided to install software that may later handle API keys, OAuth flows, or trading-related actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The component table again advertises npx -y gate-mcp without a pinned version, repeating the same supply-chain exposure. Users may treat the table as authoritative installation guidance, so this expands the likelihood that an unreviewed future package version is executed. Because this skill installs MCP tooling for a developer assistant environment, compromise could affect local systems and any connected exchange credentials.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill appears to require code-capable actions such as editing local configuration and handling environment-related setup, but it does not declare an explicit tool scope or permissions boundary. That omission weakens least-privilege controls and makes it easier for an agent/runtime to perform broader actions than the user may expect during installation.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
## General Rules

⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding.
Do NOT select or call any tool until all rules are read. These rules have the highest priority.
→ Read [gate-runtime-rules.md](https://github.com/gate/gate-skills/blob/master/skills/gate-runtime-rules.md)
- **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they
  exist in the MCP server.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

Using npx -y gate-mcp without pinning a specific version causes execution of whatever package version is current at install time. This creates a supply-chain risk: a compromised, malicious, or simply breaking upstream release could be installed and executed on the user's machine.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
92% confidence
Finding

Writing and merging entries into ~/.cursor/mcp.json creates persistent session-level changes that survive beyond the current interaction. Because the skill defaults to installing multiple MCP servers, this persistence expands the future trust surface and may affect later sessions in ways the user did not explicitly review.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md
- If the user does not specify which MCPs → install all: `main`, `cex-public`, `cex-exchange`, `dex`, `info`, `news`.
- If the user specifies "only install xxx" → install only the specified MCPs.

### 2. Write Cursor MCP Config

- Config file: `~/.cursor/mcp.json` (Windows: `%APPDATA%\Cursor\mcp.json`).
- If it already exists, **merge** into the existing `mcpServers`; do not overwrite other MCPs.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs modification of ~/.cursor/mcp.json but does not prominently warn the user that local configuration will be changed and persisted. Silent or weakly disclosed config mutation can surprise users, alter future agent behavior, and create an unsafe precedent for persistent trust changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Copying all subdirectories from a remote repository into ~/.cursor/skills/ performs broad local file installation without an explicit safety notice or per-item review. This increases the chance of introducing unreviewed skills that may later run with agent privileges or influence future sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The one-click installer command is presented as a simple bash invocation without clearly stating that it will modify persistent configuration and install local files. Users may execute it without understanding the extent of changes, which is especially risky when the script is sourced from a repository and may perform network-dependent actions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/mcp.md (reported line 70)May include surrounding context.

md
1. Never overwrite unrelated MCP server blocks.
2. Abort and explain on malformed JSON or merge conflict.
3. Do not claim success without verification.
4. Mask secrets in user-visible output.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script advertises a fixed DEX API key embedded for all users, which is inappropriate for a local installer and can route usage through a shared credential outside the user's control. Shared hardcoded credentials undermine attribution, may expose users to unauthorized third-party access patterns, and create revocation or abuse risk if the key is compromised or rate-limited.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The installer unconditionally deletes any existing destination skill directory and replaces it, which can destroy locally modified content or overwrite previously trusted versions without user consent. In a security-sensitive toolchain, silent replacement also makes downgrade or malicious-content substitution easier if the upstream repository or selected branch is compromised.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 37)May include surrounding context.

md
{
  "Gate-News": {
    "url": "https://api.gatemcp.ai/mcp/news",
    "transport": "streamable-http"
  }
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 38)May include surrounding context.

md
{
  "Gate-News": {
    "url": "https://api.gatemcp.ai/mcp/news",
    "transport": "streamable-http"
  }
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

md
{
  "Gate-News": {
    "url": "https://api.gatemcp.ai/mcp/news",
    "transport": "streamable-http"
  }
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 40)May include surrounding context.

md
{
  "Gate-News": {
    "url": "https://api.gatemcp.ai/mcp/news",
    "transport": "streamable-http"
  }
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

md
{
  "Gate-News": {
    "url": "https://api.gatemcp.ai/mcp/news",
    "transport": "streamable-http"
  }
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
{
  "Gate-News": {
    "url": "https://api.gatemcp.ai/mcp/news",
    "transport": "streamable-http"
  }
}

Static analysis

No suspicious patterns detected.