Okx Dex Token

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:10 AM UTC
• Version: 3.1.3

Overview

The skill is mostly coherent for OKX token research, but it automatically downloads and runs a latest-version installer from GitHub, which should be reviewed before installation.

Review the installer/update behavior before installing. This skill may install or refresh a local OKX CLI from the latest GitHub release, so only use it if you trust OKX's release process and are comfortable with user-level code execution. Treat wallet analytics, holder lists, PnL, funding-source data, and API credentials as sensitive when using or sharing results.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: _shared/preflight.md:18

Finding

Dynamic Download and Execution of a Remote Installer

Content

View full analysis

Vulnerability Details

File Location: _shared/preflight.md, lines 18–29
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash

# macOS/Linux
curl -sSL "https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.sh" -o /tmp/onchainos-install.sh
curl -sSL "https://github.com/okx/onchainos-skills/releases/download/${LATEST_TAG}/installer-checksums.txt" -o /tmp/installer-checksums.txt

# Windows
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.ps1" -OutFile "$env:TEMP\onchainos-install.ps1"
Invoke-WebRequest -Uri "https://github.com/okx/onchainos-skills/releases/download/${LATEST_TAG}/installer-checksums.txt" -OutFile "$env:TEMP\installer-checksums.txt"

# After checksum verification
sh /tmp/onchainos-install.sh
# or:
& "$env:TEMP\onchainos-install.ps1"

The preceding instruction dynamically obtains LATEST_TAG from:

bash

curl -sSL "https://api.github.com/repos/okx/onchainos-skills/releases/latest"

Technical Analysis

The mandatory preflight procedure resolves the latest release at runtime, downloads an installer, and executes it with the privileges of the Agent process. This creates a remote code-execution channel whose effective payload can change after the Skill package has been reviewed.

The source belongs to the GitHub organization corresponding to the declared OKX publisher rather than an unrelated personal paste service, and the procedure requires SHA-256 verification. These controls reduce accidental corruption and some tampering risks. They do not, however, eliminate the supply-chain trust issue because the installer and its checksum are retrieved from the same upstream administrative trust boundary. Compromise of the repository, publisher account, release workflow, or release assets could allow an attacker to replace both artifacts consistently.

Resolving the latest release rather than using an audite ...[truncated 1573 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer to a specifically audited release instead of resolving the latest release dynamically.
2. Embed the expected installer digest in the reviewed Skill package rather than downloading both the installer and its checksum from the same trust boundary.
3. Verify signed release artifacts using a publisher signing key whose trust anchor is distributed independently of the release repository.
4. Require explicit, informed user approval before installing or updating executable software.
5. Separate dependency installation from routine token-data operations; do not automatically update an already functional binary merely because a periodic cache has expired.
6. Display the resolved version, source URL, signer identity, and verification result before execution.
7. Run installation with the minimum necessary user privileges and avoid requesting elevated privileges.
8. Preserve a verified prior version and provide a rollback mechanism if installation or post-installation validation fails.

T09 · Insecure Skill Coding Practices

Warning

• Location: _shared/preflight.md:18

Finding

Predictable Shared Temporary Files Permit Symlink and Race Attacks

Content

View full analysis

Vulnerability Details

File Location: _shared/preflight.md, lines 18–40
Vulnerability Type: Unsafe temporary-file handling
Risk Level: Medium

Vulnerable Code

bash

curl -sSL "https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.sh" -o /tmp/onchainos-install.sh
curl -sSL "https://github.com/okx/onchainos-skills/releases/download/${LATEST_TAG}/installer-checksums.txt" -o /tmp/installer-checksums.txt

# Verify the installer's SHA256 against installer-checksums.txt.

sh /tmp/onchainos-install.sh

The same pattern is used for the installed binary’s checksum:

bash

curl -sSL "https://github.com/okx/onchainos-skills/releases/download/v<version>/checksums.txt" -o /tmp/onchainos-checksums.txt

Technical Analysis

The macOS/Linux procedure stores security-sensitive files under fixed, predictable names in the shared /tmp directory. It does not require:

• Creation of a private temporary directory.
• Restrictive permissions or a secure umask.
• Rejection of symbolic links.
• Ownership and regular-file checks.
• Atomic preservation of the verified installer between validation and execution.
• Cleanup of temporary artifacts.

This enables local symlink attacks and time-of-check/time-of-use races. A local process able to manipulate the relevant temporary paths may pre-create a symbolic link before the download or replace the installer after its checksum is validated but before the shell executes it.

The Windows examples also use predictable names in the user temporary directory, although the exact exploitability depends on that directory’s access controls. The clearest shared-directory risk is the explicitly documented /tmp workflow on macOS and Linux.

Attack Path

A substitution attack can proceed as follows:

1. A local attacker predicts /tmp/onchainos-install.sh.
2. The attacker monitors creation and validation of that file.
3. After checksum validation but before sh /tmp/onchainos-install.sh, t ...[truncated 1357 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a unique private directory with mktemp -d and fail if creation is unsuccessful:

   bash

   umask 077
   tmpdir="$(mktemp -d)" || exit 1
   trap 'rm -rf "$tmpdir"' EXIT
   

2. Store the installer and checksum only inside that private directory.

3. Verify that each downloaded artifact is a regular file owned by the current user and is not a symbolic link.

4. Use restrictive file permissions, such as mode 0600, until execution is necessary.

5. Prevent replacement between verification and execution. Prefer verification and execution through a protected file descriptor or use an atomic rename within the private directory after verification.

6. Avoid shared, fixed paths such as /tmp/onchainos-install.sh.

7. Ensure download tools fail on HTTP errors, for example by using curl --fail --show-error --location.

8. Remove all temporary artifacts on success, failure, interruption, and signal termination.

9. Apply equivalent unique-file and access-control protections to the Windows temporary-file workflow.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md

- **Network error**: retry once
- **Region restriction (error code 50125 or 80001)**: do NOT show the raw error code to the user. Instead, display a friendly message: `⚠️ Service is not available in your region. Please switch to a supported region and try again.`

## Amount Display Rules

- Use appropriate precision: 2 decimals for high-value, significant digits for low-value
- Market cap / liquidity in shorthand ($1.2B, $45M)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · _shared/preflight.md (reported line 9)May include surrounding context.

1. Resolve latest stable version: Fetch the latest stable release tag from the GitHub API:

   text

   curl -sSL "https://api.github.com/repos/okx/onchainos-skills/releases/latest"
   

   Extract the tag_name field (e.g., v1.0.5) into LATEST_TAG. If the API call fails and onchainos is already installed locally, skip steps 2-3

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Line L03 states that users may use Chinese crypto slang and frames the glossary around Chinese terminology mappings, but the file does not indicate that language handling is optional or that other locales are equally supported. This can violate language/locale policy when a skill implicitly centers a specific language without explicit user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file documents commands that expose holder wallet addresses, funding sources, balances, and PnL, but it does not include any warning that these outputs may involve sensitive on-chain profiling data. Under the markdown-file criteria for missing user warnings, documentation should disclose behaviors that could affect privacy or reveal sensitive user or third-party data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trades command documentation states that users can filter by wallet addresses and retrieve userAddress values, but it provides no warning about the privacy implications of querying and displaying address-linked trading activity. For markdown documentation, omission of a warning about privacy-affecting behavior is a reportable issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This is a markdown file, so SQP-2 applies to omissions in warnings about privacy or system-impacting behavior. The document explains how to send API key, passphrase, and a signature derived from the secret key to the OKX WebSocket service, but aside from advising not to hardcode secrets, it does not explicitly warn that the skill or client will transmit sensitive authentication material to an external endpoint.

Content

No source excerpt is available for this finding.