Security audit

Okx Dex Signal

Security checks across malware telemetry and agentic risk

Overview

This OKX market-signal skill is mostly coherent, but it can install/update a remote CLI and delegates paid API handling to instructions that are not included for review.

Install only if you are comfortable with an agent installing or updating the onchainos CLI from OKX GitHub releases. Require explicit confirmation before any paid x402/API-quota action, avoid treating signal output as financial advice, and provide OKX API credentials only when you intentionally use the WebSocket workflow.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill metadata explicitly says WebSocket script/bot requests should be handled by a different skill, but this file still contains direct WebSocket monitoring commands and protocol guidance. That inconsistency can cause the agent to route users into capabilities outside the declared boundary, weakening skill isolation and increasing the chance of unsafe or incorrect tool use.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill is scoped to tracking, signals, leaderboard, and quota/payment handling, yet it recommends `swap execute` as a next step. Suggesting an execution action from a read-oriented analytics skill can nudge the agent into transaction-capable behavior beyond the declared permission boundary, which raises the risk of unintended financial actions.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: Using the standalone trigger phrase `信号` is overly broad and can match many ordinary Chinese requests unrelated to DEX smart-money alerts. Overbroad routing terms can cause accidental invocation of this skill, exposing irrelevant market actions or causing the agent to follow the wrong workflow in ambiguous contexts.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The preflight instructions direct the agent to download and execute a remote installer script (`install.sh` / `install.ps1`) on the user's system. Although a checksum is checked, this still authorizes remote code execution and system modification without explicit user consent at the point of action, which is dangerous in an agent context because it turns routine skill use into privileged installation behavior.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The glossary includes very broad activation terms such as 'signal' and generic tracking phrases that can match ordinary user requests without enough contextual constraints. In an agent-routing setting, this can cause unintended invocation of the skill, leading the system to fetch or present trading-related data when the user did not clearly request this specific capability.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.