Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to be a legitimate OKX Earn monitor, but it sets up persistent automated execution and includes high-impact financial action guidance with some unsafe scoping choices.
Review before installing if you are comfortable with a persistent OKX monitoring job that runs under your account context. Use a dedicated low-privilege OKX profile/API key where possible, avoid giving withdrawal permission unless you intend transfer flows, inspect ~/.okx/earn-hunter/env.snapshot, and require explicit confirmation before any redeem, transfer, or purchase command.
Referenced artifact was not completely inspected
ion/config management. The recurring **scan itself is performed entirely by `scripts/scan.sh`** (shell + jq) — `jq` is required for scanning. Verify with `which
Referenced artifact was not completely inspected
ion/config management. The recurring **scan itself is performed entirely by `scripts/scan.sh`** (shell + jq) — `jq` is required for scanning. Verify with `which
Referenced artifact was not completely inspected
ion/config management. The recurring **scan itself is performed entirely by `scripts/scan.sh`** (shell + jq) — `jq` is required for scanning. Verify with `which
Referenced artifact was not completely inspected
ion/config management. The recurring **scan itself is performed entirely by `scripts/scan.sh`** (shell + jq) — `jq` is required for scanning. Verify with `which
Referenced artifact was not completely inspected
ion/config management. The recurring **scan itself is performed entirely by `scripts/scan.sh`** (shell + jq) — `jq` is required for scanning. Verify with `which
Referenced artifact was not completely inspected
ion/config management. The recurring **scan itself is performed entirely by `scripts/scan.sh`** (shell + jq) — `jq` is required for scanning. Verify with `which
Referenced artifact was not completely inspected
ion/config management. The recurring **scan itself is performed entirely by `scripts/scan.sh`** (shell + jq) — `jq` is required for scanning. Verify with `which
Referenced artifact was not completely inspected
ion/config management. The recurring **scan itself is performed entirely by `scripts/scan.sh`** (shell + jq) — `jq` is required for scanning. Verify with `which
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
b, no CLI commands). The job runs as an **isolated, light-context** agent turn and delivers its output back to the conversation channel via cron **`announce`** delivery. notify.channel defaults to `"session"` so the scan prints to stdout for `announce` to push (avoids double-send).
**Claude Code / Hermes / Generic (`claude-code.default.json`):**
- scheduler.type = `"cron"` — scheduled via **OS crontab → `scripts/scan.sh`** (zero LLM token cost), notification via TG / Lark curl from the script itself.
### Notification Channels (independent of platform)
Detect in priority order (PRD requirement: TG first):
1. **Telegram** — `$TELEGRAM_BOT_TOKEN` and `$TELEGRAM_CHAT_ID` both set → TG ready
2. **Lark** — `platform.notify.lark_webhook` non-empty → Lark ready
3. **Session** — fallback, only works in interactive mode
TG and Lark are **standalone push channels** — they work regardless of whether the agent client is open. On OS-crontab platforms, scheduled scans send notific
The skill includes a direct file-deletion command targeting a path in the user's home directory. Although scoped to its own plist, destructive shell operations are dangerous in skills because path expansion mistakes, later edits, or command injection in surrounding logic could remove unintended files.
When user says "卸载" / "uninstall":
1. Stop the scheduler (same as Pause). For LaunchAgent, also remove the plist:
`launchctl unload ~/Library/LaunchAgents/com.okx.earn-hunter.plist && rm -f ~/Library/LaunchAgents/com.okx.earn-hunter.plist`
2. Ask: "是否保留配置和历史数据？"
- Yes → only remove scheduler
- No → also remove `~/.okx/earn-hunter/` directory
The use of shell chaining (&&) ties scheduler control and file deletion into a single compound command. Chained commands are harder to audit and can amplify the effect of partial failures or later unsafe variable substitution if the command evolves.
When user says "卸载" / "uninstall":
1. Stop the scheduler (same as Pause). For LaunchAgent, also remove the plist:
`launchctl unload ~/Library/LaunchAgents/com.okx.earn-hunter.plist && rm -f ~/Library/LaunchAgents/com.okx.earn-hunter.plist`
2. Ask: "是否保留配置和历史数据？"
- Yes → only remove scheduler
- No → also remove `~/.okx/earn-hunter/` directory
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
ding which applies avoids confusion.
### 1. Interactive Session (user is in a live conversation)
The agent outputs markdown directly in the conversation. Works on all platforms (OpenClaw, Claude Code, Hermes, Generic). Full interactivity — user can reply to subscribe immediately.
### 2. OS Crontab (scheduled scan, no LLM session) — Claude Code / Hermes / Generic
Scheduled scans run via OS crontab (no LLM session). **Always use direct curl to TG Bot API or Lark Webhook** for notifications. `scripts/scan.sh` does the curl itself.
### 3. OpenClaw In-Session Cron (`announce` delivery)
On OpenClaw the scheduled scan runs as an **isolated cron agent turn** created via the in-session `cron` tool. Delivery is via the cron job's **`announce`** mode, which pushes the turn's output back to the conversation channel that created the job. `platform.json` `notify.channel` is `"session"` so `scripts/scan.sh` prints the notification to stdout for the turn to relay — **do not curl TG/Lark fr
The document claims earn-hunter does not directly execute write operations, yet it includes operational instructions for redeeming flexible earn positions and transferring funds from trading to funding accounts before purchase. This contradiction can mislead both users and orchestration layers about the skill's true capabilities, weakening trust boundaries and increasing the risk that write actions occur under a supposedly read-only skill.
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
current_flash_ids = [p.id for each in flash_results]
For each key in state.flash:
Extract id from key (split by ":" → first element)
If id not in current_flash_ids → delete state.flash[key]
Skip any key starting with "test:" (Test Mode immunity)
# 6b. Fixed diff cleanup: key-level
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
current_flash_ids = [p.id for each in flash_results]
For each key in state.flash:
Extract id from key (split by ":" → first element)
If id not in current_flash_ids → delete state.flash[key]
Skip any key starting with "test:" (Test Mode immunity)
# 6b. Fixed diff cleanup: key-level
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
current_flash_ids = [p.id for each in flash_results]
For each key in state.flash:
Extract id from key (split by ":" → first element)
If id not in current_flash_ids → delete state.flash[key]
Skip any key starting with "test:" (Test Mode immunity)
# 6b. Fixed diff cleanup: key-level
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
# Scheduler Setup
Two scheduling models, selected by `platform.json` `.scheduler.type`:
- **`openclaw-cron`** (OpenClaw) — scheduled via the in-session **`cron` agent tool**, isolated + light-context, delivered back to the conversation via `announce`. See [OpenClaw](#openclaw-in-session-cron-tool).
- **`cron`** (Claude Code / Hermes / Generic) — scheduled via **OS crontab + `okx` CLI + curl notifications**. No LLM sessions spawned — zero token cost. See [OS Crontab](#os-crontab-configuration).
For OS-crontab platforms, agent-platform `/loop` and cloud Routines are **not recommended**: each tick spawns an LLM session and isolated sessions cannot reliably push TG/Lark notifications. (OpenClaw is the deliberate exception — its in-session cron + `announce` delivery is the supported path.)
## OpenClaw (in-session cron tool)
OpenClaw does **not** use OS crontab or the `openclaw` CLI (the CLI cron path has permission issues here). Scheduling is created
The script unconditionally sources env.snapshot from a user-writable state directory, which executes arbitrary shell code with the privileges of the scanning process. Because EH_STATE_DIR can redirect the state location and the file is treated as trusted shell, any attacker who can modify that file or influence the state directory can achieve code execution during cron or agent runs.
The skill invokes shell commands extensively but does not declare an explicit tool scope or allowed-tools boundary. That increases the chance the agent executes broader command capabilities than required, which is risky in a skill that installs software, edits scheduler state, and writes files under the user's home directory.
The manifest uses broad natural-language trigger phrases such as 'monitor earn' and 'notify me about earn', which may overlap with normal conversation and invoke the skill unexpectedly. In a skill that can install software, inspect environment state, and establish persistence, accidental activation materially increases risk.
The skill directs the agent to install additional skills and system packages beyond pure monitoring, including optional OKX skills and jq. Expanding dependencies and modifying the host environment broadens the attack surface and can lead to unintended code execution or supply-chain risk if those packages are compromised.
The skill initializes and maintains a persistent directory under ~/.okx/earn-hunter containing config, state, scripts, and environment snapshots. Persistent local state is not inherently malicious, but it creates long-lived execution context and can store sensitive operational metadata that later scheduled tasks rely on.
- No API key + `okx auth status --json` → `"status":"logged_in"` → **OAuth mode**. No `--profile` flag needed.
- Neither → **stop**. Load `okx-cex-auth` skill and follow login steps.
5. Init config and state:
- If `~/.okx/earn-hunter/` directory does not exist → `mkdir -p ~/.okx/earn-hunter`
- If `~/.okx/earn-hunter/config.json` does not exist → copy `{baseDir}/config/default.json` to it
- If `~/.okx/earn-hunter/state.json` does not exist → write `{"flash":{},"fixed":{},"flexible":{},"consecutive_failures":0,"last_error":""}`
- If `~/.okx/earn-hunter/platform.json` does not exist → run [Platform Detection](#platform-detection-active-probe--user-confirmation)
The routing table includes ambiguous phrases like 'stop' and 'subscribe' that could match ordinary conversation and trigger state-changing flows such as pausing monitoring or entering a purchase guide. Ambiguous activation is especially risky here because the skill manages persistent jobs and can steer financial actions.
Writing platform.json is a persistence mechanism that affects future behavior of the skill across sessions. In isolation it is low-risk, but within this skill it controls notification and scheduler behavior, so unintended writes can influence future automated execution.
### Step 1 — Platform Detection & Confirmation
See [Platform Detection](#platform-detection-active-probe--user-confirmation). Probe environment → ask user to confirm → write `platform.json`.
### Step 2 — Detect Notification Channel & Confirm
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
5. User confirms → proceed to Step 5
6. Not received → troubleshoot (see `notify-channels.md`)
7. 5 min no response → ping once
8. Session channel → skip confirmation
**Note:** The smoke test ignores `verboseLog` setting — it always produces output to verify the full pipeline works end-to-end.
No suspicious patterns detected.