okx-cex-bot

• Outcome: Review
• Latest audit: Sep 7, 2026 · 9:27 AM UTC
• Version: 1.4.6

Overview

This OKX bot skill is transparent about its trading purpose, but it needs Review because it can control real trading bots while using overbroad credential-profile checks and an unpinned global CLI install path.

Install only if you are comfortable giving the OKX CLI access to the relevant OKX account and understand that live mode can create, amend, or stop bots using real funds. Prefer demo mode for testing, pin the CLI install to the reviewed version, and avoid exposing or sharing raw `okx config show --json` output unless you have verified secrets are redacted.

A.I.G

By Tencent

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:39
• Finding: Sensitive API-Key Profile Data May Be Exposed to Agent Context and Logs< Step 2 and remembered for the session. ### Step A — Verify credentials Run **both** commands — the `apiKey` field from `okx auth status --json` is the auth-binary's internal state and is always `false` regardless of whether `~/.okx/config.toml` has an API-key profile. `okx config show --json` is the only authoritative source for API-key presence. ```bash okx config show --json # reveals API-key profiles (TOML config) okx auth status --json # reveals OAuth session state (auth-binary state) ``` Apply **in this order** — first match wins: - `config show --json` has any profile with a non-empty `api_key` field → **API Key mode**. Proceed to Step B. ``` ### Technical Analysis The Skill instructs the Agent to execute `okx config show --json` before every authenticated command and inspect whether an `api_key` field is non-empty. The document explicitly states that this command reveals API-key profiles. Using complete configuration output for a credential-presence check violates data-minimization principles. If the command does not comprehensively redact sensitive fields, API keys or related account configuration can enter the Agent's tool context, command logs, transcripts, telemetry, or debugging output. Repeating this operation before every authenticated command unnecessarily increases the number of opportunities for disclosure. The Skill appropriately tells users not to submit credentials in chat, but that protection does not address credentials exposed by local command output. ### Attack Path 1. A user invokes an authenticated Grid or DCA bot operation. 2. The Agent follows the Skill and runs `okx config show ...[truncated 1083 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace complete configuration output with a purpose-built status operation that returns only: - Profile name - Live or demo mode - A boolean indicating whether credentials are configured 2. Ensure the CLI redacts API keys, secrets, passphrases, OAuth tokens, and other sensitive fields by default. 3. Do not place raw configuration objects in model context. 4. If no safer command exists, filter the output locally before it is returned to the Agent. The filter should use an allowlist rather than attempting to enumerate sensitive field names. 5. Perform the credential-mode check once per session unless authentication state changes, rather than before every command. 6. Add explicit instructions never to reproduce configuration output in user-facing responses or persistent logs. 7. Add automated tests confirming that all credential-status commands remain redacted across both API-key and OAuth authentication modes. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31
• Finding: Prerequisite Command Installs an Unpinned Global npm Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 13-18 and 31-34 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code The frontmatter identifies a specific reviewed package version: ```yaml install: - id: npm kind: node package: "@okx_ai/okx-trade-cli@1.4.6" bins: ["okx"] label: "Install okx CLI (npm)" ``` However, the prerequisite command omits that version: ```markdown ## Prerequisites ```bash npm install -g @okx_ai/okx-trade-cli okx config init # select site -> follow browser OAuth flow ``` ``` ### Technical Analysis The metadata pins `@okx_ai/okx-trade-cli` to version `1.4.6`, but the documented prerequisite installs the package without a version constraint. npm will therefore resolve the latest version available under that package name rather than the version represented by the audited Skill metadata. This creates a review-to-runtime mismatch: the installed code can change after the Skill has been reviewed. npm installation can also execute package lifecycle scripts with the privileges of the installing user. A compromised maintainer account, malicious future release, registry compromise, or unintended incompatible release could consequently introduce code not covered by this audit. Global installation increases exposure because it places the executable in the user's shared command path and makes it available outside this Skill's execution context. ### Attack Path 1. A user follows the prerequisite instructions and runs `npm install -g @okx_ai/okx-trade-cli`. 2. npm resolves the package version marked as latest at installation time, not necessarily version `1.4.6`. 3. An attacker publishes or causes resolution to a compromised later release, or compromises the package's distribution channel. 4. npm downloads the altered package and may execute its lifecycle scripts during installation. 5. The resulting global `okx` executable runs with the use ...[truncated 950 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the prerequisite command to the exact reviewed version: ```bash npm install -g @okx_ai/okx-trade-cli@1.4.6 ``` 2. Keep the frontmatter version, package version, and prerequisite command synchronized through an automated release check. 3. Verify npm package provenance, signatures, and integrity metadata before installation. 4. Prefer a project-local or isolated installation over a global installation where operationally possible. 5. Review package lifecycle scripts and consider disabling them during installation when they are not required. 6. Maintain a lockfile or equivalent immutable dependency record for all transitive dependencies used to build or distribute the CLI. 7. Re-audit and explicitly approve every package-version upgrade before updating the pinned version. ]]>

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill enables authenticated live trading operations that can create, amend, and stop bots using real funds, but it does not present a prominent, repeated risk warning before those write paths. In a trading context, insufficient warning can lead users or agents to execute high-impact financial actions in live mode without appreciating liquidation, loss, or unintended fund exposure risks.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.