Okx Defi Portfolio

• Outcome: Review
• Latest audit: May 29, 2026 at 9:39 PM UTC
• Version:
  3.1.3

Overview

This OKX DeFi portfolio skill is mostly a read-only portfolio viewer, but its all-wallets flow can switch active wallet accounts without a documented restore or confirmation step.

Review before installing if you use multiple OKX wallet accounts. Prefer providing a public address manually when possible, and after any all-wallets query confirm which wallet account is active before making transactions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill instructs the agent to enumerate all wallet accounts and switch across them when the user says 'check all accounts' or 'all wallets,' which expands data access beyond the minimum needed for a portfolio-viewing action. In an agent setting, this increases the chance of over-collection and unintended disclosure of holdings from multiple accounts, especially if the user did not explicitly understand the scope of enumeration and switching.

VirusTotal

65/65 vendors flagged this skill as clean.