Security checks for vulnerabilities and agentic risk
Overview
This bridge skill is mostly coherent, but it needs review because it can move funds and routinely downloads and executes an updatable installer from GitHub.
Review this before installing. It is designed for real cross-chain token movement, so only use it with wallets and amounts you intend to control through OKX OnchainOS. Require a visible prompt before any install or update, and before any approval, force, skip-approve, route pinning, or non-default receive address.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content
Scanner excerpt · SKILL.md (reported line 570)May include surrounding context.
md
**Re-evaluate every time the amount changes** — do NOT carry over `--mev-protection` from a previous command when the user modifies the amount.
## Amount Display Rules
- Display amounts in UI units: `1.5 ETH`, `3,200 USDC`.
- CLI `--readable-amount` accepts human-readable amounts; CLI converts to raw units automatically.
Autonomous Decision Making
Medium
Category
Excessive Agency
Confidence
85% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content
Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.
md
2. `onchainos token search --query <symbol> --chains <chain>` — for all other symbols. Search on the CORRECT chain (--from-chain for source, --to-chain for destination).
3. User provides full CA directly — if the address is an EVM contract address with mixed case, you MUST: (a) immediately convert to all lowercase, (b) only ever display the lowercase version, (c) remind the user "EVM contract addresses must be all lowercase — converted for you."
After `token search`, you MUST show results and wait for user confirmation before proceeding. Multiple results → numbered list with name/symbol/CA/chain/marketCap, ask user to pick. Single match → show details and ask user to confirm. **Never skip confirmation** — wrong token = permanent fund loss.
</IMPORTANT>
## Execution Flow
External Transmission
Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · _shared/preflight.md (reported line 9)May include surrounding context.
Resolve latest stable version: Fetch the latest stable release tag from the GitHub API:
text
Extract the tag_name field (e.g., v1.0.5) into LATEST_TAG.
If the API call fails and onchainos is already installed locally, skip steps 2-3
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The preflight instructs the agent to download and execute a remote installer script that modifies the local system. Although it includes checksum verification, this still performs code execution sourced from the network and does so as a routine prerequisite, which creates meaningful supply-chain and local-environment risk if the release channel, checksum source, or transport path is compromised.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding
This section documents one-shot cross-chain execution that can approve tokens, sign, and broadcast on-chain transactions, but it does not consistently require an explicit user confirmation and risk warning at the point of action. In a bridging skill, that is material because approvals and swaps are irreversible, may expose token allowances, and can move assets across chains where recovery is difficult or impossible.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding
The manifest describes a skill for cross-chain bridging, quoting, approvals, execution, and status tracking through bridge protocols. This section instructs users to invoke onchainos wallet history and run a bash loop with python3 parsing, which introduces wallet-history inspection and arbitrary local shell scripting capabilities not justified by the bridge skill's declared scope.
Content
No source excerpt is available for this finding.
Vague Triggers
Low
Category
Not specified by scanner
Confidence
88% confidence
Finding
The manifest description says to use the skill broadly whenever the user mentions bridging or moving tokens between chains, but it does not define narrower activation boundaries or exclusion conditions. This can cause unintended invocation overlap with general asset-transfer discussions or multi-step portfolio conversations.
Content
No source excerpt is available for this finding.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
86% confidence
Finding
The instruction to avoid echoing routine command output reduces transparency around network access, downloads, integrity checks, and installation behavior. In a skill that may install or update software, suppressing these details makes it harder for users to notice unexpected actions or intervene before local changes occur.
