search CA & Token

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:13 PM UTC
• Version: 1.0.0

Overview

This is a coherent OKX market-data helper that sends token queries to OKX with API credentials, with credential-handling cautions but no hidden persistence or destructive behavior.

Install only if you intend to use OKX Web3 Market API data. Use a least-privileged OKX API key, keep secrets in environment variables or a secret manager, and avoid pasting real keys, passphrases, or signatures into prompts, shared terminals, logs, or code examples.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: 整体上，代码的主要目的与声明较为接近，确实是一个 OKX 市场数据查询 SDK，并实现了价格、K线、成交、指数价格、代币搜索和代币信息等核心能力。不过声明列出的两项具体能力——“代币排行榜”和“持仓大户信息”——在代码中都没有对应实现，因此描述比实际能力更宽。另一个值得注意的点是，代码需要使用 API key/secret/passphrase 并进行签名访问，但声明未提及鉴权要求；这更像实现细节而非核心能力偏差。综合来看，存在描述与实现范围不一致的情况，应判定为 mismatch。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The code substantially matches the core market-data portion of the description: it queries token prices, K-line/candlestick data, recent trades, index prices, token search, and token details/trading info from OKX Web3 market endpoints. The authentication/signing logic is a normal implementation detail, not a mismatch. However, the declared description explicitly includes viewing token rankings and obtaining holder/large-holder information, and those capabilities are not present anywhere in the supplied code. Because these are concrete advertised functions rather than minor wording differences, this is a description-to-behavior mismatch, though the overall domain and primary purpose remain aligned.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill documents and includes code that uses network access and handles API credentials/signing, but it declares no explicit tool scope or permissions boundary. In an agent environment, this can cause the skill to be invoked with broader runtime capabilities than users or platform policy expect, increasing the chance of unintended outbound requests or secret handling.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger list is broad enough to match many generic market-data requests, which can cause the skill to activate more often than intended. In an agent setting, overbroad routing can silently send user queries to an external authenticated API when a local answer or narrower tool would suffice, increasing privacy and unintended-action risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill requires authenticated requests with API key, signature, and passphrase, yet it does not clearly warn that prompts and token identifiers may be transmitted to an external third-party service. This creates a real transparency and data-handling issue: users and operators may not realize that externally routed requests are occurring under stored credentials.

External Transmission

Medium

• Category: Data Exfiltration

Content

**示例**
```bash
curl -X POST 'https://web3.okx.com/api/v6/dex/index/current-price' \
  -H 'Content-Type: application/json' \
  -H 'OK-ACCESS-KEY: your-api-key' \
  -H 'OK-ACCESS-SIGN: your-signature' \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

**示例**
```bash
curl -X POST 'https://web3.okx.com/api/v6/dex/market/price-info' \
  -H 'Content-Type: application/json' \
  -H 'OK-ACCESS-KEY: your-api-key' \
  -H 'OK-ACCESS-SIGN: your-signature' \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: L010-L011 将“代币价格、币价、K线、行情、market data、holder”等作为触发词，其中“行情”“market data”“holder”范围较宽，且未说明限定上下文或排除条件。该描述缺少更明确的触发边界，容易与一般性的市场讨论或非 OKX 场景查询重叠。

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document instructs users to send sensitive API credentials in HTTP headers and shows signing workflows, but provides no warning about secure secret storage, redaction, least-privilege handling, or avoiding exposure in logs and transcripts. In an agent environment, this increases the risk that API keys, passphrases, or signatures are copied into prompts, code snippets, debugging output, or other unintended sinks.

External Transmission

Medium

• Category: Data Exfiltration

Content

**示例**
```bash
curl -X POST 'https://web3.okx.com/api/v6/dex/index/current-price' \
  -H 'Content-Type: application/json' \
  -H 'OK-ACCESS-KEY: your-api-key' \
  -H 'OK-ACCESS-SIGN: your-signature' \

• Confidence: 84% confidence
• Finding: This example demonstrates transmitting authenticated requests with sensitive headers to an external service, which is expected for the API but still creates a real exposure surface if copied into agent workflows without safeguards. The danger is not the outbound request itself, but that users may paste real credentials into commands, shell history, logs, notebooks, or shared environments while interacting with the external endpoint.

External Transmission

Medium

• Category: Data Exfiltration

Content

**示例**
```bash
curl -X POST 'https://web3.okx.com/api/v6/dex/market/price-info' \
  -H 'Content-Type: application/json' \
  -H 'OK-ACCESS-KEY: your-api-key' \
  -H 'OK-ACCESS-SIGN: your-signature' \

• Confidence: 84% confidence
• Finding: Like the earlier POST example, this snippet normalizes sending sensitive authentication headers to an external service without any compensating guidance on secure handling. In agent-assisted contexts, such examples can lead to credential leakage through copied commands, transcript retention, observability tooling, or accidental sharing of signed requests.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The module docstrings, method descriptions, and user-facing printed labels are presented in Chinese only, with no indication of alternative language support or user opt-in. Per the policy, forcing a specific language without offering a choice is a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: This markdown file presents all instructions, error descriptions, and troubleshooting guidance only in Chinese. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in or an explicit justification is a natural-language policy violation.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: The manifest describes a market-data lookup skill for token prices, candles, trades, search, and holder information. In the example entrypoint, the code additionally accesses environment variables to obtain API credentials, which is a capability not justified by the user-facing purpose and expands the skill’s interaction with host runtime state.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: This code accesses sensitive credentials from environment variables (`OKX_API_KEY`, `OKX_SECRET_KEY`, and `OKX_PASSPHRASE`). While the example includes general usage comments, it does not clearly warn the user that credential material will be read from the local environment.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The entire markdown reference is written in Chinese, including headings and usage guidance, with no indication that users may choose another language or locale. This can violate a language/locale policy when a skill imposes one language by default without user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: 该 markdown 文件全文仅以中文呈现，包括标题、说明和排障步骤，未说明这是特定区域专用文档，也未提供其他语言选项或用户选择机制。按照语言/locale 政策，若无明确的地区限定或用户自选，强制单一语言可能构成自然语言层面的政策问题。

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: This code accesses sensitive secrets (API key, secret key, and passphrase) from environment variables and then uses them to authenticate HTTP requests. While the file contains technical docstrings, it does not provide an explicit user-facing warning in the executable path about handling credentials or that requests will be sent to OKX using those credentials.