OKX Competition Manager

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:18 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed automated OKX trading workflow, but it gives high-impact live-trading and persistent background-execution instructions with weak safeguards.

Review carefully before installing. Keep it in OKX Demo mode unless you fully understand the financial risk, use restricted API keys with withdrawals disabled, do not run the provided VBS scheduler as written, and independently inspect any referenced trading scripts before giving them API credentials or allowing live trading.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:139
• Finding: Persistent Execution Through Windows Task Scheduler<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 139–161 **Vulnerability Type**: `T06: System Persistence` **Risk Level**: High ### Vulnerable Code ```vbs ### Step 6: Automate with Task Scheduler (Windows) Create `guardian.vbs` for zero-flash auto-restart: ```vbs ' guardian.vbs — starts competition if not running Set oShell = CreateObject("WScript.Shell") Set oFS = CreateObject("Scripting.FileSystemObject") lockFile = "C:\Users\User\.openclaw\workspace\bybit-trading\competition.lock" If oFS.FileExists(lockFile) Then pid = Trim(oFS.OpenTextFile(lockFile,1).ReadLine()) ' Check if PID is alive (WMI) strCmd = "powershell -Command ""(Get-Process -Id " & pid & " -ErrorAction SilentlyContinue) -ne $null""" result = oShell.Run(strCmd, 0, True) If result = 0 Then WScript.Quit ' Still running End If ' Start competition oShell.Run "cmd /c node C:\Users\User\.openclaw\workspace\bybit-trading\competition_manager_okx.js >> competition.log 2>&1", 0, False ``` Register in Task Scheduler: every 2 minutes, run as user, run whether logged in or not. ``` ### Technical Analysis The Skill explicitly directs users to create a Windows scheduled task that runs every two minutes, including while the user is logged out. The guardian launches or relaunches `competition_manager_okx.js`, establishing cross-session persistence for the trading process. Persistent execution may be operationally useful for a continuous trading service, but it exceeds the minimum privileges necessary to demonstrate, test, or manually run a paper-trading Skill. The risk is amplified because the JavaScript file being launched is not included in the audited project. Its behavior, network destinations, credential handling, and trading controls therefore cannot be verified. The process executes with the permissions of the account configured for the scheduled task. It may consequently inherit access to the workspace, user files, environment configuration, and trade-enabled O ...[truncated 1498 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not configure cross-session scheduled execution by default. Use explicit, interactive startup for demo and evaluation workflows. 2. If continuous operation is essential, ship and audit every script that the scheduled task executes before recommending installation. 3. Require explicit, informed user consent before creating persistence and clearly distinguish demo operation from live trading. 4. Run the task under a dedicated, non-administrative service account with access limited to the required application directory and demo credentials. 5. Configure the task to execute a fixed, integrity-verified application path rather than code that can be replaced by ordinary workspace modifications. 6. Avoid hidden execution during setup and provide observable logs, health status, and failure notifications. 7. Document exact commands for disabling and deleting the scheduled task. 8. Do not permit the persistent process to access live-trading credentials by default. Use demo-only API keys with narrowly scoped permissions. 9. Protect application files and secrets using restrictive filesystem ACLs, and rotate credentials if the persisted executable changes unexpectedly. 10. Consider a supervised service with explicit installation, signed artifacts, restricted privileges, and integrity validation instead of an ad hoc recurring task. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:147
• Finding: PowerShell Command Injection Through Unvalidated Lock-File Content<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 147–155 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Code ```vbs lockFile = "C:\Users\User\.openclaw\workspace\bybit-trading\competition.lock" If oFS.FileExists(lockFile) Then pid = Trim(oFS.OpenTextFile(lockFile,1).ReadLine()) ' Check if PID is alive (WMI) strCmd = "powershell -Command ""(Get-Process -Id " & pid & " -ErrorAction SilentlyContinue) -ne $null""" result = oShell.Run(strCmd, 0, True) If result = 0 Then WScript.Quit ' Still running End If ``` ### Technical Analysis The guardian reads the first line of `competition.lock` and concatenates it directly into a PowerShell command. It does not verify that the value is an integer or otherwise constrain its syntax. Although the value is named `pid`, it is treated as executable command text. A party able to modify the lock file can insert PowerShell metacharacters, expressions, or additional commands. `WScript.Shell.Run` then passes the constructed string to PowerShell for interpretation. This violates the fundamental rule that untrusted file content must not be inserted into shell commands without strict validation. The recurring scheduled-task configuration increases exploitability because the vulnerable code is executed automatically every two minutes. ### Attack Path 1. An attacker, compromised local process, or malicious replacement for the trading process obtains write access to: `C:\Users\User\.openclaw\workspace\bybit-trading\competition.lock`. 2. The attacker replaces the expected numeric PID with content containing PowerShell syntax and an additional command. 3. The scheduled guardian starts and reads the malicious first line. 4. The guardian concatenates the line into `powershell -Command` without validation or safe argument handling. 5. `WScript.Shell.Run` invokes PowerShell, which interprets the injected syntax. 6. The injected command executes with t ...[truncated 1243 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not construct a PowerShell command from lock-file content. 2. Validate the lock-file value before any use. Accept only ASCII decimal digits and reject empty, signed, fractional, out-of-range, or trailing content. 3. Convert the validated value to an integer and enforce the valid Windows PID range. 4. Prefer a process-query API that does not invoke a shell. For example, query WMI directly from VBScript using a numeric predicate created only after strict integer conversion. 5. If PowerShell is unavoidable, pass arguments through a mechanism that keeps data separate from command syntax. Validation is still required. 6. Create the lock file with restrictive ACLs so only the dedicated service account can modify it. 7. Place the lock file in a protected application-state directory rather than a broadly writable workspace. 8. Verify that the identified process is the expected Node.js executable and command line, not merely any process that reused the PID. 9. Remove stale lock files safely and use an atomic, ownership-checked process-locking mechanism. 10. Run the guardian under a dedicated least-privilege account that cannot access unrelated user files or live-trading secrets. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The live-trading section gives concrete steps for switching from demo to real-money trading but does not present a strong, explicit warning about the possibility of losing funds through market movement, automation failure, API misuse, or sizing/configuration errors. In the context of an autonomous trading skill, this omission materially increases user harm because it lowers friction to enabling real-money execution.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The description includes broad activation-oriented phrasing such as 'Use for: algorithmic trading research, paper trading, building toward live trading' without specifying when this skill should or should not be invoked. In a markdown skill file, this can overlap with many general trading-related requests and lacks exclusion conditions or a precise trigger scope.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The documentation labels demo trading as 'zero risk' while the same skill explicitly supports transition to live trading with real funds. That framing can mislead users into underestimating financial, operational, and configuration risks, especially because the rest of the document normalizes autonomous execution and provides a direct path to live deployment.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The documentation claims evolution does not modify the live agent configuration and should never be auto-applied without human review, yet elsewhere describes an unattended daily replacement workflow for losing agents. This inconsistency can cause operators to rely on controls that may not actually exist, increasing the chance of unauthorized or unsafe strategy changes in an autonomous trading system.