Okx Dex Token

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:10 AM UTC
• Version: 3.1.3

Overview

The skill is mostly coherent for OKX token research, but it automatically downloads and runs a latest-version installer from GitHub, which should be reviewed before installation.

Review the installer/update behavior before installing. This skill may install or refresh a local OKX CLI from the latest GitHub release, so only use it if you trust OKX's release process and are comfortable with user-level code execution. Treat wallet analytics, holder lists, PnL, funding-source data, and API credentials as sensitive when using or sharing results.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: _shared/preflight.md:18
• Finding: Dynamic Download and Execution of a Remote Installer## Vulnerability Details **File Location**: `_shared/preflight.md`, lines 18–29 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash # macOS/Linux curl -sSL "https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.sh" -o /tmp/onchainos-install.sh curl -sSL "https://github.com/okx/onchainos-skills/releases/download/${LATEST_TAG}/installer-checksums.txt" -o /tmp/installer-checksums.txt # Windows Invoke-WebRequest -Uri "https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.ps1" -OutFile "$env:TEMP\onchainos-install.ps1" Invoke-WebRequest -Uri "https://github.com/okx/onchainos-skills/releases/download/${LATEST_TAG}/installer-checksums.txt" -OutFile "$env:TEMP\installer-checksums.txt" # After checksum verification sh /tmp/onchainos-install.sh # or: & "$env:TEMP\onchainos-install.ps1" ``` The preceding instruction dynamically obtains `LATEST_TAG` from: ```bash curl -sSL "https://api.github.com/repos/okx/onchainos-skills/releases/latest" ``` ### Technical Analysis The mandatory preflight procedure resolves the latest release at runtime, downloads an installer, and executes it with the privileges of the Agent process. This creates a remote code-execution channel whose effective payload can change after the Skill package has been reviewed. The source belongs to the GitHub organization corresponding to the declared OKX publisher rather than an unrelated personal paste service, and the procedure requires SHA-256 verification. These controls reduce accidental corruption and some tampering risks. They do not, however, eliminate the supply-chain trust issue because the installer and its checksum are retrieved from the same upstream administrative trust boundary. Compromise of the repository, publisher account, release workflow, or release assets could allow an attacker to replace both artifacts consistently. Resolving the latest release rather than using an audite ...[truncated 1573 chars]
• Remediation: ## Remediation Suggestions 1. Pin the installer to a specifically audited release instead of resolving the latest release dynamically. 2. Embed the expected installer digest in the reviewed Skill package rather than downloading both the installer and its checksum from the same trust boundary. 3. Verify signed release artifacts using a publisher signing key whose trust anchor is distributed independently of the release repository. 4. Require explicit, informed user approval before installing or updating executable software. 5. Separate dependency installation from routine token-data operations; do not automatically update an already functional binary merely because a periodic cache has expired. 6. Display the resolved version, source URL, signer identity, and verification result before execution. 7. Run installation with the minimum necessary user privileges and avoid requesting elevated privileges. 8. Preserve a verified prior version and provide a rollback mechanism if installation or post-installation validation fails.

T09 · Insecure Skill Coding Practices

Warning

• Location: _shared/preflight.md:18
• Finding: Predictable Shared Temporary Files Permit Symlink and Race Attacks## Vulnerability Details **File Location**: `_shared/preflight.md`, lines 18–40 **Vulnerability Type**: Unsafe temporary-file handling **Risk Level**: Medium ### Vulnerable Code ```bash curl -sSL "https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.sh" -o /tmp/onchainos-install.sh curl -sSL "https://github.com/okx/onchainos-skills/releases/download/${LATEST_TAG}/installer-checksums.txt" -o /tmp/installer-checksums.txt # Verify the installer's SHA256 against installer-checksums.txt. sh /tmp/onchainos-install.sh ``` The same pattern is used for the installed binary’s checksum: ```bash curl -sSL "https://github.com/okx/onchainos-skills/releases/download/v<version>/checksums.txt" -o /tmp/onchainos-checksums.txt ``` ### Technical Analysis The macOS/Linux procedure stores security-sensitive files under fixed, predictable names in the shared `/tmp` directory. It does not require: - Creation of a private temporary directory. - Restrictive permissions or a secure `umask`. - Rejection of symbolic links. - Ownership and regular-file checks. - Atomic preservation of the verified installer between validation and execution. - Cleanup of temporary artifacts. This enables local symlink attacks and time-of-check/time-of-use races. A local process able to manipulate the relevant temporary paths may pre-create a symbolic link before the download or replace the installer after its checksum is validated but before the shell executes it. The Windows examples also use predictable names in the user temporary directory, although the exact exploitability depends on that directory’s access controls. The clearest shared-directory risk is the explicitly documented `/tmp` workflow on macOS and Linux. ### Attack Path A substitution attack can proceed as follows: 1. A local attacker predicts `/tmp/onchainos-install.sh`. 2. The attacker monitors creation and validation of that file. 3. After checksum validation but before `sh /tmp/onchainos-install.sh`, t ...[truncated 1357 chars]
• Remediation: ## Remediation Suggestions 1. Create a unique private directory with `mktemp -d` and fail if creation is unsuccessful: ```bash umask 077 tmpdir="$(mktemp -d)" || exit 1 trap 'rm -rf "$tmpdir"' EXIT ``` 2. Store the installer and checksum only inside that private directory. 3. Verify that each downloaded artifact is a regular file owned by the current user and is not a symbolic link. 4. Use restrictive file permissions, such as mode `0600`, until execution is necessary. 5. Prevent replacement between verification and execution. Prefer verification and execution through a protected file descriptor or use an atomic rename within the private directory after verification. 6. Avoid shared, fixed paths such as `/tmp/onchainos-install.sh`. 7. Ensure download tools fail on HTTP errors, for example by using `curl --fail --show-error --location`. 8. Remove all temporary artifacts on success, failure, interruption, and signal termination. 9. Apply equivalent unique-file and access-control protections to the Windows temporary-file workflow.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

- **Network error**: retry once
- **Region restriction (error code 50125 or 80001)**: do NOT show the raw error code to the user. Instead, display a friendly message: `⚠️ Service is not available in your region. Please switch to a supported region and try again.`

## Amount Display Rules

- Use appropriate precision: 2 decimals for high-value, significant digits for low-value
- Market cap / liquidity in shorthand ($1.2B, $45M)

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

External Transmission

Medium

• Category: Data Exfiltration

Content

1. **Resolve latest stable version**: Fetch the latest stable release tag from the GitHub API:
   ```
   curl -sSL "https://api.github.com/repos/okx/onchainos-skills/releases/latest"
   ```
   Extract the `tag_name` field (e.g., `v1.0.5`) into `LATEST_TAG`.
   If the API call fails and `onchainos` is already installed locally, skip steps 2-3

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: Line L03 states that users may use Chinese crypto slang and frames the glossary around Chinese terminology mappings, but the file does not indicate that language handling is optional or that other locales are equally supported. This can violate language/locale policy when a skill implicitly centers a specific language without explicit user opt-in or documented justification.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: This markdown file documents commands that expose holder wallet addresses, funding sources, balances, and PnL, but it does not include any warning that these outputs may involve sensitive on-chain profiling data. Under the markdown-file criteria for missing user warnings, documentation should disclose behaviors that could affect privacy or reveal sensitive user or third-party data.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The `trades` command documentation states that users can filter by wallet addresses and retrieve `userAddress` values, but it provides no warning about the privacy implications of querying and displaying address-linked trading activity. For markdown documentation, omission of a warning about privacy-affecting behavior is a reportable issue.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: This is a markdown file, so SQP-2 applies to omissions in warnings about privacy or system-impacting behavior. The document explains how to send API key, passphrase, and a signature derived from the secret key to the OKX WebSocket service, but aside from advising not to hardcode secrets, it does not explicitly warn that the skill or client will transmit sensitive authentication material to an external endpoint.

Static analysis

No suspicious patterns detected.