Security audit

okx-cex-smartmoney

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly coherent read-only OKX analytics helper, but it asks the agent to inspect OKX credential profile data and installs a persistent npm CLI, so it should be reviewed before use.

Install only if you are comfortable with an agent running the OKX CLI and seeing OKX profile/auth status output. Prefer read-only, least-privilege OKX API credentials, verify that any config/status output redacts secrets before use, and avoid using keys with trading or withdrawal permissions for this analytics workflow.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:47
Finding: Credential Profile Data Is Exposed to Agent Context
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:11
Finding: Globally Installed npm Dependency Lacks Verifiable Integrity Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 70% confidence
Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
Content: Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.
md
- **Security:** Never ask users to paste API keys or secrets into chat. - **Output:** Always pass `--json` to list/query commands and render results as a Markdown table — never paste raw terminal output. - **Network errors:** If commands fail with a connection error, prompt user to check VPN: `curl -I https://www.okx.com` - **Language:** Always respond in the user's language. - **Time inputs:** `signal-trend-by-{filter,trader}` take an optional `--asOfTime <yyyyMMddHH>` anchor (10-digit UTC hour); omit to use the current UTC hour. `--limit` controls how many buckets are returned ending at that anchor. `signal-overview-by-{filter,trader}` takes no time input — handler always uses the current hour. For number/time formatting and response structure conventions, read `{baseDir}/references/templates.md`.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
md
### Step 2 — Execute and present All commands are READ-only — no confirmation needed. Always pass `--json` and render results as Markdown tables. For multi-step workflows (recommend traders then drill down, signal analysis with context), read `{baseDir}/references/workflows.md`.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.
md
## Global Notes - **Security:** Never ask users to paste API keys or secrets into chat. - **Output:** Always pass `--json` to list/query commands and render results as a Markdown table — never paste raw terminal output. - **Network errors:** If commands fail with a connection error, prompt user to check VPN: `curl -I https://www.okx.com` - **Language:** Always respond in the user's language.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The field description uses Chinese unit labels ("币" and "张") directly in the English-language reference, effectively imposing a specific locale in the skill documentation. This can violate language/locale policy when no user choice or explicit regional justification is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The workflow repeatedly presents user invocations as fixed Chinese/English example phrases, but the document does not state that the skill should respect the user's preferred language or offer a language choice. Under the policy rule, forcing a specific language or locale without opt-in can be a natural-language policy issue.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.