ClawHub
Back to skill

Security audit

okx-dex

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its OKX DEX purpose, but it includes under-declared financial transaction tooling with a hardcoded wallet address that users should review before installing.

Review and preferably remove or edit scripts/test_okx.sh before use, especially the hardcoded userWalletAddress. Only use OKX API credentials you intend to expose to this skill, verify wallet address, token, amount, slippage, approval target, and decoded calldata before signing anything, and do not treat generated transaction data as ready to broadcast without independent wallet confirmation.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/test_okx.sh:53
Finding
Hardcoded Third-Party Wallet Address in Swap Transaction Generation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/test_okx.sh:53-59` **Vulnerability Type**: Unsafe hardcoded financial transaction parameter **Risk Level**: Medium ```bash echo "4) Swap Transaction" call "GET" "/api/v6/dex/aggregator/swap?chainIndex=1&fromTokenAddress=0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE&toTokenAddress=0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48&amount=500000000000000000&swapMode=exactIn&slippagePercent=0.01&userWalletAddress=0xaa4e09ab283e207bd7171d924db2dda49315637b" | jq '{ tx: .data[0].tx, router: .data[0].routerResult.router, priceImpactPercent: .data[0].routerResult.priceImpactPercent, dexRouterList: (.data[0].routerResult.dexRouterList // []) }' ``` ### Technical Analysis The executable test script requests swap transaction data using the fixed wallet address `0xaa4e09ab283e207bd7171d924db2dda49315637b` instead of obtaining the executing user's wallet address. A wallet address is a security-sensitive transaction parameter because the API may use it when constructing calldata, determining the sender or recipient context, applying routing behavior, or associating the transaction with a user. The hardcoded address is not required for the skill's declared functionality. The minimum necessary behavior is to accept a wallet address explicitly from the user, validate it, and display it for confirmation before requesting transaction data. The script does not access private keys, sign transactions, or broadcast generated transactions. Therefore, it does not independently transfer funds or obtain wallet privileges. The vulnerability becomes exploitable only if a user treats the output as production-ready, signs it, and broadcasts it without verifying the embedded transaction details. ### Attack Path 1. A user configures valid `OKX_API_KEY`, `OKX_SECRET_KEY`, and `OKX_PASSPHRASE` credentials. 2. The user executes `scripts/test_okx.sh`, expecting swap transaction data relevant to their own wallet. 3. The script sub ...[truncated 1541 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove the hardcoded wallet address and require an explicit environment variable: ```bash : "${USER_WALLET_ADDRESS:?USER_WALLET_ADDRESS must be set}" ``` 2. Validate that the supplied value is a correctly formatted EVM address before making the request: ```bash if [[ ! "$USER_WALLET_ADDRESS" =~ ^0x[0-9a-fA-F]{40}$ ]]; then echo "Invalid EVM wallet address" >&2 exit 1 fi ``` 3. URL-encode all user-controlled query parameters rather than interpolating them directly into the request URL. 4. Display the wallet address, token pair, amount, chain, and slippage before requesting or presenting transaction data. 5. Require explicit user confirmation before transaction generation when the script is used interactively. 6. Clearly label `scripts/test_okx.sh` as test-only and warn that returned calldata must be independently decoded and verified before signing. 7. Add an assertion that the wallet represented in the generated transaction context matches the user-provided wallet whenever the API response exposes sufficient information. 8. Ensure `_meta.json` accurately lists all distributed executable files, including `scripts/test_okx.sh`, so reviewers and package users are aware of the script. ]]>

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill uses shell execution and reads sensitive environment variables containing API credentials, but it does not declare an explicit tool scope such as allowed-tools or permissions. In an agent environment, this weakens isolation and reviewability: the skill can invoke shell commands and access secrets without a clearly declared capability boundary, increasing the risk of unintended command execution, secret exposure, or broader misuse if the skill is composed with other agent behaviors.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
SKILL.md:47