Security audit

Earn Hunter

Security checks across malware telemetry and agentic risk

Overview

Earn Hunter fits its OKX monitoring purpose, but it also sets up persistent background scanning and includes crypto fund-movement and purchase flows that need careful review.

Install only if you are comfortable granting an OKX-focused skill access to authenticated account data, local ~/.okx state, external notification channels, and recurring background execution. Before activation, confirm exactly which scheduler will be created, where notifications and logs go, and require explicit confirmation before any transfer, redemption, or purchase command is run.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: This section sets up persistent OS-level scheduling via crontab or LaunchAgent, which goes beyond one-shot monitoring and creates recurring execution on the host. Even if intended for periodic scans, persistence materially increases risk because compromise of the copied script or later config changes can turn the scheduled task into a durable execution mechanism.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The guide explicitly states earn-hunter does not perform write operations, yet later includes transfer and redeem commands that move user funds. This inconsistency is dangerous because an agent or operator may rely on the safer description while the documented flow still authorizes balance-affecting actions, increasing the chance of unintended or insufficiently reviewed fund movements.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill is presented as a monitoring and notification tool, but the purchase guide expands its role into operational fund routing and redemption steps. That mismatch weakens user consent and least-privilege expectations, because a user invoking a monitoring skill may not anticipate commands that transfer assets or redeem positions.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrases include generic expressions such as 'monitor earn' and similar natural-language variants that can overlap with ordinary conversation. Because this skill can install software, write files, and schedule recurring tasks, accidental activation could lead to unintended host modification and external notifications.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The routing table accepts generic control phrases like 'stop', 'pause', 'subscribe', and 'uninstall' without clear scoping to this skill. In a multi-skill environment, such broad routing can cause the wrong skill to seize control and perform destructive or persistent actions unexpectedly.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill description and early setup flow do not prominently warn that activation will install packages, copy scripts, create files under ~/.okx, and potentially register persistent schedulers. For a skill with host-modifying behavior, insufficient upfront disclosure is dangerous because user consent may not be informed.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The notification design sends opportunity data to Telegram or Lark, but the skill does not present this as a prominent privacy and data egress warning before activation. External push channels can leak trading interests, product availability, and usage patterns to third-party services if users are not clearly informed.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation instructs the agent to directly copy defaults and write configuration files, including a full reset operation, without requiring user confirmation or warning that existing settings will be overwritten. In a skill that manages persistent user config under ~/.okx/earn-hunter, this can cause unintended loss of customized monitoring, notification, and scheduler settings and makes destructive state changes too easy for an autonomous agent to perform.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The instructions say to restart the scheduler after frequency changes but do not require a warning or confirmation before modifying system scheduling state. Because this skill may use OS crontab or LaunchAgent on some platforms, an agent following these instructions could alter persistent background execution behavior without making the user aware of the side effects.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The file mandates writing notification outcomes to a local log containing channel, timestamps, and delivery details, but does not instruct the agent to warn users that these records persist on disk. Persistent notification metadata can reveal behavioral patterns, assets of interest, or external channel identifiers to other local users or later processes.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: Broad trigger phrases like generic buy/subscribe language increase the risk that the skill activates in unintended contexts, especially in a financial workflow tied to account balances and subscription guidance. Accidental invocation can expose balances, initiate transactional guidance, or prime the user for risky follow-on actions without clear intent.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This documentation instructs the operator to copy a script into the user's home directory and install a persistent cron job, which changes the local system state and creates ongoing execution without an explicit warning or consent checkpoint. In a skill context, persistence is security-relevant because it can continue running outside the immediate user interaction and may be overlooked by users.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The file states that notifications are sent via curl to Telegram/Lark but does not warn that scan results and metadata will be transmitted to third-party services. Even if the payload is intended to be harmless, external transmission can expose financial activity patterns, account-related context, or misconfigured secrets if logs/messages are too verbose.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.