Security audit

OKX Competition Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed automated OKX trading workflow, but it gives high-impact live-trading and persistent background-execution instructions with weak safeguards.

Review carefully before installing. Keep it in OKX Demo mode unless you fully understand the financial risk, use restricted API keys with withdrawals disabled, do not run the provided VBS scheduler as written, and independently inspect any referenced trading scripts before giving them API credentials or allowing live trading.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

Location: SKILL.md:139
Finding: Persistent Execution Through Windows Task Scheduler
Content: View full analysis
> competition.log 2>&1", 0, False ``` Register in Task Scheduler: every 2 minutes, run as user, run whether logged in or not. ``` ### Technical Analysis The Skill explicitly directs users to create a Windows scheduled task that runs every two minutes, including while the user is logged out. The guardian launches or relaunches `competition_manager_okx.js`, establishing cross-session persistence for the trading process. Persistent execution may be operationally useful for a continuous trading service, but it exceeds the minimum privileges necessary to demonstrate, test, or manually run a paper-trading Skill. The risk is amplified because the JavaScript file being launched is not included in the audited project. Its behavior, network destinations, credential handling, and trading controls therefore cannot be verified. The process executes with the permissions of the account configured for the scheduled task. It may consequently inherit access to the workspace, user files, environment configuration, and trade-enabled O ...[truncated 1498 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:147
Finding: PowerShell Command Injection Through Unvalidated Lock-File Content
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The live-trading section gives concrete steps for switching from demo to real-money trading but does not present a strong, explicit warning about the possibility of losing funds through market movement, automation failure, API misuse, or sizing/configuration errors. In the context of an autonomous trading skill, this omission materially increases user harm because it lowers friction to enabling real-money execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The description includes broad activation-oriented phrasing such as 'Use for: algorithmic trading research, paper trading, building toward live trading' without specifying when this skill should or should not be invoked. In a markdown skill file, this can overlap with many general trading-related requests and lacks exclusion conditions or a precise trigger scope.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation labels demo trading as 'zero risk' while the same skill explicitly supports transition to live trading with real funds. That framing can mislead users into underestimating financial, operational, and configuration risks, especially because the rest of the document normalizes autonomous execution and provides a direct path to live deployment.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The documentation claims evolution does not modify the live agent configuration and should never be auto-applied without human review, yet elsewhere describes an unattended daily replacement workflow for losing agents. This inconsistency can cause operators to rely on controls that may not actually exist, increasing the chance of unauthorized or unsafe strategy changes in an autonomous trading system.
Content: No source excerpt is available for this finding.