okx-cex-bot

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:06 PM UTC
• Version: 1.3.8

Overview

This appears to be an OKX trading-bot skill, but it deserves review because it can control real trading bots and its install and credential-check steps are under-scoped.

Review before installing. Pin the CLI install to the reviewed version, avoid elevated/global installs where possible, confirm whether `okx config show --json` masks secrets before using it, prefer demo mode for testing, and only allow live bot create/amend/stop actions after explicit user confirmation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:26

Finding

Unpinned Global npm Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26-29
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code

bash

npm install -g @okx_ai/okx-trade-cli
okx config init   # select site -> follow browser OAuth flow

Technical Analysis

The documented installation command retrieves the latest available version of @okx_ai/okx-trade-cli, despite the Skill frontmatter identifying version 1.3.7 as the expected dependency. Consequently, the package installed by users may differ from the version associated with the reviewed Skill.

A global npm installation can execute package lifecycle scripts with the permissions of the invoking user. Because the dependency's implementation is not included in this project, its behavior cannot be verified as part of this audit. An unpinned dependency can change after review due to a legitimate incompatible release, package-account compromise, registry compromise, or malicious publication.

Attack Path

1. An attacker compromises the npm package, its publisher account, or its distribution process.
2. The attacker publishes a malicious release under the legitimate package name.
3. A user follows the documented npm install -g @okx_ai/okx-trade-cli instruction.
4. npm resolves and installs the attacker-controlled latest release rather than the reviewed 1.3.7 release.
5. Malicious package code or lifecycle scripts execute under the user's local account.
6. The malicious package can access files available to that account, including OKX configuration or authentication state, and can tamper with subsequent trading operations.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user performing the installation. The affected scope may include local files, environment variables, npm configuration, OKX API profiles, OAuth state, and trading operations available through tho ...[truncated 125 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the installation command to the version declared in the Skill metadata:

  bash

  npm install -g @okx_ai/okx-trade-cli@1.3.7
  

• Keep the dependency version in the installation instructions synchronized with metadata.version.

• Verify package provenance and registry signatures where supported.

• Use a lockfile or an equivalent integrity-pinning mechanism when packaging the dependency locally.

• Review package lifecycle scripts before installation and consider installing with scripts disabled when operationally possible.

• Avoid elevated installation privileges and execute the CLI under a dedicated, least-privileged account.

• Establish a controlled update process in which each new CLI version is reviewed before the documented version is changed.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:35

Finding

Credential Configuration Exposed to Agent Context Through Repeated Inspection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35-45
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Vulnerable Code

bash

**Run before every authenticated command.** The auth method is detected during [preflight](../_shared/preflight.md) Step 2 and remembered for the session.

### Step A — Verify credentials

Run **both** commands — the `apiKey` field from `okx auth status --json` is the auth-binary's internal state and is always `false` regardless of whether `~/.okx/config.toml` has an API-key profile. `okx config show --json` is the only authoritative source for API-key presence.

```bash
okx config show --json      # reveals API-key profiles (TOML config)
okx auth status --json      # reveals OAuth session state (auth-binary state)

text

### Technical Analysis

The Skill instructs the Agent to run `okx config show --json` before every authenticated command. The documentation explicitly states that this command reveals API-key profiles and directs the Agent to inspect whether an `api_key` field is non-empty.

This repeatedly places credential-related configuration and profile metadata into command output handled by the Agent. The Skill does not require output redaction, prohibit raw output from being displayed, or specify a status-only interface that excludes key material. This expands access beyond the minimum information required to determine whether authentication is configured.

No instruction to transmit credentials to an external party was identified. The issue is unnecessary exposure of sensitive authentication state to Agent context, tool traces, command logs, or conversation records.

### Attack Path

1. A user requests an authenticated bot-management operation.
2. The Agent follows the mandatory pre-command procedure.
3. The Agent executes `okx config show --json`.
4. API-key profile data and related configuration are returned in 
...[truncated 994 chars]

Remediation

View remediation

Remediation Suggestions

• Replace raw configuration inspection with a dedicated status command that returns only:
  • Whether an API-key profile exists.
  • Whether OAuth is authenticated.
  • Available profile names and demo/live classification without credential values.
• Ensure all credential fields are masked at the CLI layer before output reaches the Agent.
• Perform authentication-method discovery once per session rather than before every authenticated command, unless the authentication state changes.
• Add an explicit instruction never to print, quote, summarize, persist, or forward raw credential configuration.
• Avoid returning API secrets, passphrases, OAuth tokens, or complete key identifiers in JSON output.
• Restrict credential-file permissions and ensure sensitive command output is excluded from persistent logs and telemetry.
• If a status-only command is unavailable, parse the configuration locally and return only a boolean result without exposing the underlying value to the Agent.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.