Security audit

OKX MCP Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for OKX blockchain data workflows, but it publishes and encourages installing a shared API key in a wallet and swap-related context.

Review this skill before installing. Its OKX MCP workflow is disclosed and includes confirmation for swap-related operations, but do not use the embedded shared demo key for regular work. Use your own least-privilege OKX key through an environment variable or secret manager, avoid pasting secrets into shell commands, and require explicit confirmation before any approve, swap, or transaction-instruction operation.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:16
Finding: Hardcoded Shared API Credential Exposed in Documentation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description says the skill is for using OKX OnchainOS MCP through UXC to perform blockchain-related data access and swap-planning tasks. However, the supplied code chunk only validates that the skill's markdown and YAML files contain required documentation, example commands, endpoint references, and metadata. Its primary purpose is CI/documentation linting for the skill package, not operating the OKX MCP tooling itself. This is a material description-behavior mismatch, not merely an implementation detail.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The documentation contains a hard-coded API credential and instructs users to install it for "quick trial auth," which is an unsafe secret-distribution pattern. Even if intended as a demo key, publishing shared credentials enables unauthorized reuse, abuse of the upstream service, and accidental propagation of a secret into shells, histories, logs, screenshots, and downstream automation.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file not only exposes a shared API credential but actively encourages its use without any safety warning, normalizing insecure credential-sharing practices. In a skill that supports wallet, balance, and swap-related workflows, this increases the chance that operators will trust unsafe setup steps and mishandle more sensitive credentials in adjacent high-risk operations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.