okx-sentiment-tracker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:24 AM UTC
• Version: 1.3.8

Overview

The skill is mostly for OKX news and sentiment, but it handles live OKX credentials unsafely and includes a workflow that can read private account balances and positions.

Install only if you are comfortable with a global OKX CLI and live OKX credentials. Do not paste real API secrets into command-line examples; use a safer credential setup path if available, and avoid workflows that read balances or positions unless you explicitly intend to share that account data.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:54
• Finding: Live OKX credentials are passed through command-line arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:54-56` **Vulnerability Type**: Credential exposure through process arguments and shell history **Risk Level**: High ### Vulnerable Code ```markdown **On "not available in demo" errors:** the user's current profile is configured with demo/simulated credentials. Tell the user: "News module does not support demo mode. Please switch to a live profile." Guide them to either: - Use `--profile live` if a live profile exists: `okx --profile live news latest` - Or create one: `okx config add-profile AK=<key> SK=<secret> PP=<passphrase> name=live` ``` ### Technical Analysis The profile-creation command places the API key, secret key, and account passphrase directly in command-line arguments. Command arguments are not an appropriate channel for secrets because they may be exposed through: - Shell history files. - Process inspection utilities while the command is running. - Terminal session recording. - Operating-system audit and process telemetry. - CI/CD, orchestration, or support logs that record executed commands. - Agent tool-call logs and conversational transcripts. The credentials are explicitly associated with a live profile. Although this Skill documents read-only news operations, the same credentials may be accepted by other OKX interfaces. Their effective privileges depend on how the key was provisioned and cannot be constrained by this documentation alone. ### Attack Path 1. A user follows the documented recovery instructions after receiving a demo-mode error. 2. The user substitutes real values into the `AK`, `SK`, and `PP` command arguments. 3. The shell, terminal, operating system, Agent runtime, or automation environment records the complete command. 4. A local user, malware process, log operator, or other party with access to that telemetry retrieves the credentials. 5. The exposed credentials are used against the OKX account within the permissions granted to the API key. ### Impact ...[truncated 377 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove all examples that place secrets directly in command-line arguments. - Modify the CLI to collect credentials through protected interactive prompts with terminal echo disabled. - Alternatively, accept secrets through standard input or a secure operating-system credential store rather than process arguments. - Ensure `~/.okx/config.toml` is created with restrictive file permissions and never printed in logs. - Redact credential fields from Agent tool-call records, diagnostics, telemetry, and error messages. - Require narrowly scoped, read-only API credentials for this Skill. - Warn users to rotate credentials immediately if they have already entered them in shell commands. - Document how to clear relevant shell history and automation logs after accidental exposure. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/workflows.md:342
• Finding: Workflow accesses account balances and positions outside the Skill's declared scope<![CDATA[ ## Vulnerability Details **File Location**: `references/workflows.md:342-351` **Vulnerability Type**: Least-privilege boundary violation involving private financial data **Risk Level**: Medium ### Vulnerable Code ```markdown ### Economic Data Release — Position Impact Analysis When user asks about impact of released data on positions: \`\`\` # Step 1: Get the event (this skill, ⚠️ 5s rate limit) okx news economic-calendar --region united_states --importance 3 --limit 5 # Step 2: Check user positions (okx-cex-portfolio skill) okx account positions okx account balance \`\`\` ``` This conflicts with the scope declaration in `SKILL.md:3`: ```yaml Do NOT use for market prices/candles (okx-cex-market), placing orders (okx-cex-trade), or account info (okx-cex-portfolio). ``` ### Technical Analysis The Skill declares news, sentiment, and economic-calendar functionality and expressly states that it must not be used for account information. Nevertheless, the referenced workflow instructs the Agent to invoke commands that retrieve private account positions and balances. This crosses a least-privilege boundary. Public news analysis does not inherently require access to a user's portfolio. Merely asking about the effect of economic data on “positions” is not necessarily explicit authorization to retrieve the user's complete balance and position records. Once retrieved, this sensitive data may be placed in the Agent's context, command output, logs, report generation pipeline, or third-party model processing environment. The workflow does not define consent, data minimization, redaction, retention, or isolation controls. ### Attack Path 1. The Skill is loaded for a macroeconomic or market-impact request. 2. The user asks how released economic data could affect positions. 3. The Agent follows the cross-skill workflow and invokes `okx account positions` and `okx account balance`. 4. The portfolio tool reads private account information using available OKX ...[truncated 659 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `okx account positions` and `okx account balance` from this news and sentiment Skill. - Delegate portfolio analysis exclusively to the separately scoped portfolio Skill. - Before retrieving account information, obtain explicit and informed user confirmation that identifies the data to be accessed. - Prefer user-supplied, redacted position details when full account retrieval is unnecessary. - Request only the minimum fields required for the analysis rather than the complete balance and position response. - Prevent raw account responses from being written to persistent logs or memory. - Redact account identifiers, quantities, and unrelated assets from generated reports. - Enforce capability boundaries at the tool-permission layer rather than relying only on textual instructions. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:41
• Finding: Globally installed third-party CLI is trusted without artifact integrity verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:41-44` **Vulnerability Type**: Unverified third-party executable dependency **Risk Level**: Medium ### Vulnerable Code ```markdown 1. Install `okx` CLI: ```bash npm install -g @okx_ai/okx-trade-cli ``` ``` The package metadata pins the dependency in `SKILL.md:12-17`: ```yaml install: - id: npm kind: node package: "@okx_ai/okx-trade-cli@1.3.7" bins: ["okx"] label: "Install okx CLI (npm)" ``` ### Technical Analysis The Skill's effective implementation is an external npm package, but the audited artifact contains no corresponding CLI source code, package lockfile, cryptographic checksum, signature, reproducible-build information, or verified artifact digest. Consequently, the network and credential-handling behavior of the executable cannot be validated from the project itself. Pinning version `1.3.7` reduces unintended version drift but does not protect against compromise of the package publication account, npm registry, distribution path, or already-published artifact. A global npm installation may also run package-defined lifecycle scripts and exposes the installed executable system-wide for the current environment. This is a supply-chain trust risk rather than evidence that the named package is currently malicious. ### Attack Path 1. An attacker compromises the package publisher, registry account, or package distribution infrastructure. 2. A malicious artifact is published or substituted for the expected package version. 3. A user or Agent follows the Skill's installation instructions and runs the global npm installation. 4. npm executes package-controlled installation logic with the installer process's privileges. 5. The malicious package accesses local files, environment data, or configured OKX credentials, or replaces the expected `okx` behavior. 6. Subsequent legitimate-looking Skill commands execute the compromised CLI. ### Impact Assessment A compromis ...[truncated 391 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Provide the auditable source code for the CLI or link the dependency to a verifiable source revision. - Verify the downloaded package using a trusted cryptographic digest or signed provenance record. - Use a lockfile or equivalent integrity metadata that records the exact package artifact and transitive dependencies. - Prefer a project-local, isolated installation instead of a global npm installation. - Install with an unprivileged account and avoid elevated administrator or root permissions. - Disable npm lifecycle scripts where compatible with the package's documented installation requirements. - Run the CLI in a sandbox with access limited to the required network destinations and configuration files. - Audit the dependency and its transitive dependency tree before deployment. - Monitor publisher ownership and package integrity, and define a response process for dependency compromise. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger description is extremely broad, covering generic requests like 'latest news', 'market update', and 'daily briefing'. This can cause the skill to be invoked for ambiguous requests better handled by other tools, increasing the chance of overreach, unintended credentialed API use, or the web-search fallback being activated in contexts the user did not intend.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to expand from the declared OKX API capability into unrestricted web search when API results are sparse. That increases the trust boundary, may expose the agent to prompt-injection or unreliable third-party content, and can cause the skill to act outside its advertised scope without explicit user consent.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The documentation states that all news and sentiment commands are read-only, but later instructs the agent to perform account-specific position analysis and give trading-style suggestions such as TP/SL or leverage changes. This inconsistency can mislead a supervising agent or reviewer about the true behavioral scope of the skill, increasing the chance of unintended sensitive-data access and unsafe financial guidance.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: This workflow expands a read-oriented news/sentiment skill into account-specific position analysis by directing use of portfolio data and generating actionable position-management suggestions. That scope creep can cause an agent to access sensitive financial account context and provide quasi-trading advice that the skill metadata explicitly says should be handled by other skills and only with clear user intent.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The instruction mandates language choice by inference: '--lang zh-CN for Chinese, --lang en-US for English (default).' This sets locale behavior automatically rather than offering a user choice or documenting an opt-in, which can conflict with language/locale policy requirements.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The markdown explicitly frames the workflow around a Chinese-language user query (`BTC 受哪些宏观数据冲击`) alongside English, which signals a language-specific invocation example without clarifying that users may use any preferred language. Under the policy, forcing or privileging a specific language without opt-in can be a locale/language policy concern.

Static analysis

No suspicious patterns detected.