okx_symbol_prices

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:24 PM UTC
• Version:
  1.0.0

Overview

This is a clearly disclosed OKX trading skill that can place real crypto orders only through the user's configured OKX CLI credentials and confirmation flow.

Install only if you intend to let the agent help manage OKX trades. Start in demo mode, use least-privileged OKX API keys where possible, review every order confirmation carefully, and understand that live-mode trade, cancel, leverage, and close-position actions can affect real funds.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation instructs execution of a Python script that performs outbound network access to OKX, but the skill declares no permissions to make that capability explicit. Hidden or undeclared network behavior reduces transparency for reviewers and users, and can enable unexpected data exfiltration, remote dependency on external services, or policy bypass if the runtime relies on declared permissions for enforcement. In this specific skill, the stated purpose does require network access, which makes the issue less suspicious than arbitrary networking, but it is still a real security governance gap.

VirusTotal

66/66 vendors flagged this skill as clean.