Security audit

okx-dex

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its OKX DEX purpose, but it includes under-declared financial transaction tooling with a hardcoded wallet address that users should review before installing.

Review and preferably remove or edit scripts/test_okx.sh before use, especially the hardcoded userWalletAddress. Only use OKX API credentials you intend to expose to this skill, verify wallet address, token, amount, slippage, approval target, and decoded calldata before signing anything, and do not treat generated transaction data as ready to broadcast without independent wallet confirmation.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/test_okx.sh:53
Finding: Hardcoded Third-Party Wallet Address in Swap Transaction Generation
Content: View full analysis
Remediation: View remediation
&2 exit 1 fi ``` 3. URL-encode all user-controlled query parameters rather than interpolating them directly into the request URL. 4. Display the wallet address, token pair, amount, chain, and slippage before requesting or presenting transaction data. 5. Require explicit user confirmation before transaction generation when the script is used interactively. 6. Clearly label `scripts/test_okx.sh` as test-only and warn that returned calldata must be independently decoded and verified before signing. 7. Add an assertion that the wallet represented in the generated transaction context matches the user-provided wallet whenever the API response exposes sufficient information. 8. Ensure `_meta.json` accurately lists all distributed executable files, including `scripts/test_okx.sh`, so reviewers and package users are aware of the script. ]]>

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill uses shell execution and reads sensitive environment variables containing API credentials, but it does not declare an explicit tool scope such as allowed-tools or permissions. In an agent environment, this weakens isolation and reviewability: the skill can invoke shell commands and access secrets without a clearly declared capability boundary, increasing the risk of unintended command execution, secret exposure, or broader misuse if the skill is composed with other agent behaviors.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

Code: suspicious.generated_source_template_injection
Location: SKILL.md:47