coinank-openapi

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:10 AM UTC
• Version: 1.0.3

Overview

The skill is coherent market-data tooling, but it delegates wallet/payment setup to a mutable external OKX skill and models API keys weakly, so users should review it before installing.

Install only if you are comfortable sending a CoinAnk API key to open-api.coinank.com and using OKX wallet/payment tooling for pay-per-call requests. Prefer a pinned, verified OKX skill version, keep private keys and seed phrases out of the agent environment, and independently confirm every non-zero payment amount, token, network, and recipient before authorization.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README_EN.md:148
• Finding: Unpinned Third-Party Payment Skill Installation<![CDATA[ ## Vulnerability Details **File Location**: `README_EN.md:148-155` **Additional Locations**: `README.md:148-155`, `SKILL.md:89-96` **Vulnerability Type**: Unpinned and mutable third-party dependency installation **Risk Level**: Medium ### Vulnerable Code Snippet ```text Use the latest `okx-agent-payments-protocol` skill. The newer OKX payment skill supports both Agent Payments Protocol / x402 proof-based payment and the new `charge` payment method; follow the payment method returned or required by the OKX skill. # Install OKX Onchain OS skills npx skills add okx/onchainos-skills # Log in to the wallet for Agent Payments Protocol / x402 signing onchainos wallet login ``` ### Technical Analysis The installation instructions invoke `npx skills add okx/onchainos-skills` without specifying an immutable package version, reviewed commit, integrity hash, or cryptographic signature. The instructions additionally require the “latest” payment skill, meaning the dependency executed by users may differ from the version considered during this audit. This Skill does not itself contain malicious executable code. The risk arises at the supply-chain boundary: an upstream account compromise, malicious future release, package replacement, or compromised transitive dependency could introduce attacker-controlled behavior after this package has been reviewed. The dependency is particularly sensitive because it is subsequently used for wallet login, payment authorization, x402 proof generation, and charge processing. Executing mutable third-party components in that context increases the consequences of a supply-chain compromise. ### Attack Path 1. An attacker compromises the upstream package publisher, source repository, distribution channel, or one of its executable dependencies. 2. The attacker publishes a modified release under the package reference used by the installation command. 3. A user follows the documented `npx skills add okx/onchainos-skills` instru ...[truncated 1250 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the external payment skill to a reviewed release version or immutable commit. 2. Provide and verify a cryptographic checksum, package signature, or lockfile before installation. 3. Document the expected publisher identity and official distribution channel. 4. Avoid instructing users to install the “latest” release automatically; require explicit review before upgrades. 5. Run the installer and payment helper with the minimum filesystem, environment, and network permissions required. 6. Keep API keys, private keys, seed phrases, and unrelated credentials unavailable to the dependency process. 7. Display and independently verify payment network, token, recipient, and amount immediately before authorization. 8. Document a tested compatibility matrix so users can remain on an audited version rather than automatically upgrading. ]]>

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: plugin.yaml:13
• Finding: Unexplained External Network Permission for s.cdnblock.com<![CDATA[ ## Vulnerability Details **File Location**: `plugin.yaml:13-15` **Additional Location**: `.claude-plugin/plugin.json:12-15` **Vulnerability Type**: Network allowlist exceeds the documented operational scope **Risk Level**: Low ### Vulnerable Code Snippet ```yaml api_calls: - open-api.coinank.com - s.cdnblock.com ``` The equivalent Claude plugin manifest contains: ```json "api_calls": [ "open-api.coinank.com", "s.cdnblock.com" ] ``` ### Technical Analysis The project declares outbound access to `s.cdnblock.com`, but the audited runtime workflow and all 18 OpenAPI reference documents use `https://open-api.coinank.com` as the API server. No reviewed instruction explains why `s.cdnblock.com` is required, what data may be sent to it, or which operation depends on it. An unexplained network allowlist entry violates least-privilege principles. Even though no code or instruction in the audited package was found actively transmitting data to this domain, retaining the permission creates an unnecessary destination that future, delegated, or compromised logic could use. This finding is a configuration-level exposure rather than evidence of confirmed data exfiltration. The audit found no credential-forwarding logic and no current request workflow targeting `s.cdnblock.com`. ### Attack Path 1. The plugin is installed with outbound access to both declared domains. 2. A future update, compromised delegated component, or manipulated runtime instruction invokes the unused `s.cdnblock.com` permission. 3. The component sends requests or data to that host under the authority granted by the manifest. 4. If sensitive headers or wallet-related authorization data are mistakenly included, the external destination may receive information outside the documented CoinAnk API flow. The current audited files do not implement steps 2 through 4; the risk is enabled by the unnecessary permission. ### Impact Assessment The permission provides an additional outbo ...[truncated 529 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `s.cdnblock.com` from both plugin manifests if it is not required. 2. If the domain is operationally necessary, document its exact purpose, endpoint paths, expected request data, and trust relationship. 3. Restrict outbound access to the smallest necessary set of hosts and paths. 4. Explicitly prohibit sending CoinAnk API keys, payment headers, wallet-session credentials, private keys, seed phrases, or authorization proofs to this domain. 5. Add automated consistency checks ensuring every declared network destination is represented in reviewed documentation or OpenAPI specifications. 6. Require security review before adding or changing external destinations. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (49)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The README instructs users to run `npx skills add okx/onchainos-skills` without pinning a version. Unpinned package execution can pull whatever version is current at install time, which creates a supply-chain risk: a compromised upstream release or breaking change could execute unintended code in the user's environment. In this skill's context, that risk is more serious because the installed package participates in wallet login and payment flows.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The README instructs users to run `npx skills add okx/onchainos-skills` without pinning a specific package version or commit. That creates a supply-chain risk: future package updates or a compromised upstream release could cause users to install and execute attacker-controlled code in a wallet/payment context, which is more sensitive than ordinary tooling because it may handle signing or payment flows.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This manifest-like OpenAPI file uses Chinese as the sole language for the API title, tags, summaries, and descriptions, such as the title at L004 and endpoint text at L016-L018. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale violation because no alternative locale or explicit regional justification is provided.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This manifest/config file uses Chinese as the default language for the API title and most endpoint summaries/descriptions, with no indication of user opt-in or alternative locale support. Under the policy, forcing a specific language without choice is a natural-language locale violation.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The OpenAPI metadata uses Chinese-only human-readable text such as the title "默认模块" and tag name "hyperLiquid鲸鱼". This imposes a specific language on users and integrators without any indication of language selection, localization support, or documented regional limitation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This manifest/config file contains user-facing natural language such as the API title and endpoint summaries in Chinese, beginning with "默认模块" and "两年MA乘数(API等级1)", with no indication that users can select another language. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the regional constraint is clearly documented and justified.

Session Persistence

Medium

• Category: Rogue Agent

Content

"type": "integer"
                          }
                        },
                        "marketCapList": {
                          "type": "array",
                          "items": {
                            "oneOf": [

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

"type": "integer"
                          }
                        },
                        "marketCapList": {
                          "type": "array",
                          "items": {
                            "oneOf": [

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

"type": "integer"
                          }
                        },
                        "marketCapList": {
                          "type": "array",
                          "items": {
                            "oneOf": [

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

"type": "integer"
                          }
                        },
                        "marketCapList": {
                          "type": "array",
                          "items": {
                            "oneOf": [

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This OpenAPI file uses Chinese for the title, tag names, endpoint summary, and parameter descriptions, while only small parts are in English. The policy for this audit flags language/locale constraints when a skill forces a specific language without offering user choice or documenting a justified locale restriction.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: This operation requires an `apikey` header but declares `security: []` and the document defines no `securitySchemes`, so tooling may treat the endpoint as unauthenticated even though credentials are required. In agent contexts, that mismatch can cause unsafe prompt-time credential collection, poor auth handling, and accidental transmission of user secrets without proper security UX or policy enforcement.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The spec requires users to provide an API key for an external service but does not clearly warn that the credential will be transmitted to `open-api.coinank.com`. In an agent setting, lack of explicit disclosure weakens informed consent and increases the chance users provide sensitive third-party secrets without understanding where they go.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The endpoint requires an API key header but explicitly declares no security requirements, creating a misleading contract between the spec and any consuming agent or SDK. That inconsistency can bypass security-aware tooling controls and lead to credential prompting or forwarding in ways users do not expect.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This endpoint also requires external credential transmission without an explicit warning to the user. For agent-integrated skills, that omission is security-relevant because the platform may solicit and forward secrets on the user's behalf with insufficient transparency.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: This operation mixes a required sensitive header with an empty security declaration, which is a genuine security design flaw in the API description. Consumers may mishandle or under-protect the credential because the spec does not formally identify it as authentication material.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The endpoint documents mandatory API-key use but gives no clear notice that a user secret is being sent to a third-party remote service. That gap can mislead users and integrators about the sensitivity of the action and the trust boundary being crossed.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The spec requires an API key while advertising no security requirements, which can cause client generators, gateways, or agents to misclassify the endpoint as unauthenticated. In practice, this increases the chance of secrets being collected and transmitted outside standardized auth flows and audit controls.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This authenticated endpoint lacks explicit disclosure around external credential transmission, which is a real security concern in tools that may automatically request secrets from users. Without that warning, users may not realize they are authorizing third-party access using their API credentials.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: This endpoint has the same auth-spec mismatch: a required API key header but no declared security requirement. Such mismatches are especially risky in agent ecosystems because policy engines often rely on formal auth metadata to decide whether secret access and user confirmation are required.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The specification requires sensitive credentials but omits a user-facing warning about sending them to an external service. In the context of an agent skill, this makes the issue more dangerous because the skill may normalize secret submission through conversational UX without adequate disclosure.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The kline endpoint requires credential submission but the spec omits formal security metadata, creating an inaccurate and unsafe contract for automated consumers. This can undermine consent prompts, secret scanning, and auth-aware middleware that depend on declared OpenAPI security semantics.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The kline endpoint requires an API key yet provides no explicit warning that the secret will be transmitted to an external API provider. This is a meaningful security and privacy issue for agent users, who need clear notice before disclosing third-party credentials.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This manifest file contains user-facing natural-language content such as the title and tags in Chinese, and the rest of the API descriptions are also largely Chinese. Under the language/locale policy, forcing a specific language without user opt-in or a documented regional justification is a policy concern.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The endpoint summary and schema describe active buy/sell count data with array items consisting of three numeric fields, but the example payload shows four numbers per entry, matching a different metric shape. This is an active documentation-to-spec contradiction that can mislead agents about what the operation actually returns.

Static analysis

No suspicious patterns detected.