Okx Outcomes

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:28 AM UTC
• Version: 1.3.8

Overview

The skill is mostly coherent for OKX Outcomes trading, but its installation guidance asks users to run mutable remote code directly in a shell and installs an unpinned global CLI wrapper.

Review the install path carefully before installing. Prefer a pinned release with checksum or signature verification instead of running `curl | sh`, and pin the npm wrapper to the reviewed version. Treat account balances, positions, trades, OAuth state, and the signing wallet as sensitive, and only approve write actions after checking the dry-run details.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:41

Finding

Mutable Remote Installer Is Piped Directly into a Shell

Content

View full analysis

Remediation

View remediation

/ echo " okx-outcomes.tar.gz" | sha256sum -c - ``` 4. Prefer cryptographic publisher signatures, such as Sigstore or GPG, in addition to checksums. 5. If a script remains necessary, download it to a local file, verify its signature and digest, allow inspection, and then execute it separately. 6. Pin and independently verify the binary downloaded by the installer. 7. Avoid requesting administrative privileges unless a documented installation destination strictly requires them. 8. Include the reviewed installer in the Skill artifact, or document its exact immutable source revision so its behavior can be audited. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:36

Finding

Globally Installed npm Wrapper Is Not Version-Pinned

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The | sh command chaining is the mechanism that turns a remote fetch into immediate shell execution. This removes the opportunity for user review and makes any upstream compromise or man-in-the-middle issue directly exploitable as arbitrary command execution on the endpoint.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

# 2. Outcomes binary
#    macOS / Linux:
curl -fsSL https://raw.githubusercontent.com/okx/outcomes-cli/main/install.sh | sh
#    Windows: download okx-outcomes.exe from https://github.com/okx/outcomes-cli/releases
#             and place it on your PATH.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

text

1. --key <hex>                       (NEVER pass from chat)
2. PREDICTIONS_AGENT_PRIVATE_KEY     (env override, if set)
3. keyring entry `agent_private_key` (generated by `okx outcomes setup` / `setup bind`)
4. Test-key fallback                 (localhost / mock only)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

text

1. --key <hex>                       (NEVER pass from chat)
2. PREDICTIONS_AGENT_PRIVATE_KEY     (env override, if set)
3. keyring entry `agent_private_key` (generated by `okx outcomes setup` / `setup bind`)
4. Test-key fallback                 (localhost / mock only)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

text

1. --key <hex>                       (NEVER pass from chat)
2. PREDICTIONS_AGENT_PRIVATE_KEY     (env override, if set)
3. keyring entry `agent_private_key` (generated by `okx outcomes setup` / `setup bind`)
4. Test-key fallback                 (localhost / mock only)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

text

1. --key <hex>                       (NEVER pass from chat)
2. PREDICTIONS_AGENT_PRIVATE_KEY     (env override, if set)
3. keyring entry `agent_private_key` (generated by `okx outcomes setup` / `setup bind`)
4. Test-key fallback                 (localhost / mock only)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/clob-commands.md (reported line 18)May include surrounding context.

text

1. --key <hex>                       (NEVER pass from chat)
2. PREDICTIONS_AGENT_PRIVATE_KEY     (env override, if set)
3. keyring entry `agent_private_key` (generated by `okx outcomes setup` / `setup bind`)
4. Test-key fallback                 (localhost / mock only)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/ctf-commands.md (reported line 12)May include surrounding context.

text

1. --key <hex>                       (NEVER pass from chat)
2. PREDICTIONS_AGENT_PRIVATE_KEY     (env override, if set)
3. keyring entry `agent_private_key` (generated by `okx outcomes setup` / `setup bind`)
4. Test-key fallback                 (localhost / mock only)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup-auth.md (reported line 25)May include surrounding context.

text

1. --key <hex>                       (NEVER pass from chat)
2. PREDICTIONS_AGENT_PRIVATE_KEY     (env override, if set)
3. keyring entry `agent_private_key` (generated by `okx outcomes setup` / `setup bind`)
4. Test-key fallback                 (localhost / mock only)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup-auth.md (reported line 87)May include surrounding context.

text

1. --key <hex>                       (NEVER pass from chat)
2. PREDICTIONS_AGENT_PRIVATE_KEY     (env override, if set)
3. keyring entry `agent_private_key` (generated by `okx outcomes setup` / `setup bind`)
4. Test-key fallback                 (localhost / mock only)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup-auth.md (reported line 173)May include surrounding context.

text

1. --key <hex>                       (NEVER pass from chat)
2. PREDICTIONS_AGENT_PRIVATE_KEY     (env override, if set)
3. keyring entry `agent_private_key` (generated by `okx outcomes setup` / `setup bind`)
4. Test-key fallback                 (localhost / mock only)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup-auth.md (reported line 184)May include surrounding context.

text

1. --key <hex>                       (NEVER pass from chat)
2. PREDICTIONS_AGENT_PRIVATE_KEY     (env override, if set)
3. keyring entry `agent_private_key` (generated by `okx outcomes setup` / `setup bind`)
4. Test-key fallback                 (localhost / mock only)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The install workflow tells the user to execute a remote script via curl -fsSL ... | sh without any warning, review step, version pinning, or integrity verification. This normalizes blind remote code execution and makes compromise of the script source, upstream account, or network path immediately impactful on the user's machine.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The | sh pipeline is a classic chaining-abuse pattern because it streams untrusted remote content directly into a command interpreter, preventing meaningful inspection and enabling immediate arbitrary code execution. In the context of a finance/trading skill, successful exploitation could compromise credentials, wallets, API sessions, local files, and future trading activity.

Content

Scanner excerpt · references/workflows.md (reported line 204)May include surrounding context.

md

sh --version

2. Install prebuilt binary from GitHub Releases:
   curl -fsSL https://raw.githubusercontent.com/okx/outcomes-cli/main/install.sh | sh

3. Verify:
   okx-outcomes --version

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The instruction says the skill should pick the matching workflow based on user intent, but it does not define strict activation criteria, priority rules, or exclusion conditions between similar workflows. This ambiguity can cause unintended workflow selection when user requests are underspecified or overlap multiple sections.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file includes the trigger example "set me up," which overlaps with common everyday speech and is not specific to OKX outcomes onboarding. Without tighter scoping or exclusion examples, the skill could be invoked unintentionally for unrelated requests.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The recovery workflow instructs piping a remotely fetched script directly into sh, which creates an arbitrary code execution path on the user's machine if the remote content, transport, repository, or distribution process is compromised. For a trading skill that otherwise brokers market actions, embedding software installation via unaudited shell execution expands the trust boundary significantly and is not necessary to perform the core workflow safely.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill instructs users to install the binary by piping a remote script directly into the shell. If the GitHub source, network path, or referenced script is compromised, arbitrary code will execute immediately on the host with the user's privileges, which is especially dangerous in a trading skill that manages auth state and signing keys.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

# 2. Outcomes binary
#    macOS / Linux:
curl -fsSL https://raw.githubusercontent.com/okx/outcomes-cli/main/install.sh | sh
#    Windows: download okx-outcomes.exe from https://github.com/okx/outcomes-cli/releases
#             and place it on your PATH.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

This repeats the same unsafe installation guidance in the operational flow. Because it appears in a troubleshooting path, users may run it quickly under pressure, increasing the likelihood of arbitrary code execution from a compromised remote installer.

Content

Scanner excerpt · SKILL.md (reported line 271)May include surrounding context.

okx outcomes status --json

text

- If the wrapper prints "okx-outcomes binary not found", **stop** and tell the user to install via `curl -fsSL https://raw.githubusercontent.com/okx/outcomes-cli/main/install.sh | sh`.
- If `status` returns auth errors, the user isn't signed in — check `okx outcomes auth status --json` and guide them through "Setup & Onboarding" (`auth login`).

### Step 1 — Decide what's being asked

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

This is another instance of the same remote-script execution pattern in the edge-cases section. Repetition makes the unsafe practice more likely to be copied verbatim, and compromise of the installer could expose local trading configuration, OAuth session material, or signing-key storage on the machine.

Content

Scanner excerpt · SKILL.md (reported line 337)May include surrounding context.

md

## Edge Cases

- **`okx-outcomes` not in PATH**: wrapper prints install hint and exits 127. Tell the user to run `curl -fsSL https://raw.githubusercontent.com/okx/outcomes-cli/main/install.sh | sh`.
- **Signing wallet missing**: any `clob create-order` / `market-order` / `ctf *` will fail. Run `okx outcomes setup bind --json` (agent-runnable), relay the **short link** (`deeplink` field, `https://okx.com/ul/3OauBX?eoa=…&uid=…`), and have the user open it (tap on phone → OKX app, or copy into a browser); if the link won't open, have them copy the wallet address and bind it manually in the OKX app (**Outcomes → Profile → Settings → API Bind Wallet**) — never ask for the key in chat.
- **Asset id vs market id mix-up**: the most common error class. `clob price/book/create-order/market-order` need `assetId`; `ctf *` and `account trades --market` need `marketId`. When unsure, run `event-markets <eventId>` first — its output lists both.
- **`--tif gtd` without `--expiry`**: rejected client-side. Pair them or default to `gtc`.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This markdown file documents commands that reveal authenticated trade execution history, positions, balances, and a wallet address. While it explains authentication requirements and key handling, it does not explicitly warn that these commands surface sensitive financial/account data that may be visible in terminal history, logs, or shared screenshots.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The onboarding documentation states 'No terminal' and that the agent runs every command, but the recovery section later tells the user to confirm curl/sh, run a shell installer, and verify the binary version in a terminal. That is an active contradiction in the operational guidance, even though it appears in a different workflow section.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

The recovery section introduces external script fetching as part of the agent's supported workflow, which broadens exposure to third-party content and supply-chain risk. While fetching alone is not always unsafe, in this context it is paired with execution guidance and is unnecessary to the core market-trading function of the skill.

Content

Scanner excerpt · references/workflows.md (reported line 199)May include surrounding context.

User runs any outcomes command → wrapper prints install hint.

text

1. Confirm curl + sh available (macOS / Linux):
   curl --version
   sh --version

Static analysis

No suspicious patterns detected.