GATE013: Secret retrieval capability exposed

The agent has tools that can read credentials, keys or secret-manager entries.

Name
Severity
Type
High
Description
Default severity. An individual finding may be reported higher or lower when the surrounding configuration justifies it.
Name
Capabilities
Type
secrets
Description
Capability classes this rule reasons about.
Name
Explain locally
Type
gate explain GATE013
Description
The same text, in your terminal, with no network access.

What Gate detected

Gate classified a tool or grant as carrying the secrets capability, reading from a secret manager, listing repository secrets, reading a keychain, or filesystem access to a credential directory.

A tool that returns a secret puts that secret into the agent's context window. From that moment it is in the conversation, in whatever logs record the conversation, in whatever telemetry the framework sends, and available to be included in any subsequent tool call, including one that talks to the outside world.

The combination of secret retrieval and external communication is the exfiltration path that GATE015 flags separately, and it is the single most consequential pattern in agent security.

Example

This is the shape of configuration that triggers the rule.

// vault.read_secret        -> secrets, read
// github.list_secrets      -> secrets, read
// filesystem access to ~/.aws -> secrets, read, write

Remediation

Inject credentials into the tools that need them rather than giving the agent a tool that reads them. The agent should be able to use a credential without being able to see it: that is what makes rotation and revocation meaningful.

Suppressing this rule

If this finding is acceptable in your repository, record why alongside the suppression:

gate.config.ts

export default defineConfig({
  ignore: [
    {
      rule: 'GATE013',
      reason: 'Why this is acceptable here',
    },
  ],
})

Gate refuses to apply an ignore entry with no reason. The reason is the only thing that will tell the next person whether the suppression is still true.