gate-mcp-cursorinstaller
Pass
Audited by Gen Agent Trust Hub on Mar 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a shell script (
scripts/install.sh) to manage Cursor configuration files and install skills. It usesnode -eto programmatically merge JSON configuration data into the user'smcp.jsonfile. - [EXTERNAL_DOWNLOADS]: The installer fetches the
gate-mcppackage from the NPM registry vianpxand clones thegate-skillsrepository from the vendor's GitHub organization. These resources are consistent with the identified vendor infrastructure. - [CREDENTIALS_UNSAFE]: A hardcoded API key (
MCP_AK_8W2N7Q) is present in the script and documentation. This is described as a built-in credential specifically for the Gate-Wallet MCP service provided by the vendor.
Audit Metadata