okx-cex-earn

• Outcome: Review
• Latest audit: Sep 14, 2026 · 3:40 AM UTC
• Version: 1.4.7

Overview

The skill is broadly coherent for OKX Earn management, but it uses real financial authority with overbroad credential-profile inspection and some live purchase flows that weaken final user confirmation.

Review carefully before installing. Use only an OKX profile with the minimum permissions needed, avoid withdrawal/trading permissions unless you intentionally need them, verify the installed CLI version, do not let the agent display or retain API-key configuration output, and require a separate explicit confirmation before any live subscription, redemption, transfer, or DCD quote-and-buy action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:45
• Finding: API-Key Profile Data Is Exposed to the Agent Through Mandatory Configuration Enumeration< Step 2 and remembered for the session. ```bash okx config show --json # reveals API-key profiles (TOML config) okx auth status --json # reveals OAuth session state (auth-binary state) ``` Apply **in this order** — first match wins: - `config show --json` has any profile with a non-empty `api_key` field → **API Key mode**. Proceed. ``` ### Technical Analysis The Skill requires `okx config show --json` before every authenticated operation and explicitly examines whether a profile contains a non-empty `api_key` field. This command exposes API-key profile configuration from `~/.okx/config.toml` to the command-output channel observed by the Agent. The Skill only needs to determine whether a usable API-key profile exists. Returning the complete profile configuration, including a sensitive `api_key` field, exceeds that minimum requirement. Even if the command masks some portions in a particular CLI version, the Skill does not require masking and relies on the sensitive field itself. Once credential-related output enters the Agent context, it may be retained in conversation logs, tool traces, telemetry, or downstream model-processing systems. The audited files do not establish that the value is intentionally transmitted to a non-OKX endpoint, so this finding is an exposure and data-minimization failure rather than confirmed credential exfiltration. ### Attack ...[truncated 1161 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Add or use a status-only CLI operation that returns non-sensitive booleans, such as: ```json { "hasApiKeyProfile": true, "oauthStatus": "not_logged_in" } ``` 2. Never return `api_key`, secret-key, passphrase, token, cookie, or refresh-token fields to the Agent. 3. Perform credential detection inside a trusted local component and expose only the selected authentication mode. 4. If `config show` cannot be avoided, pipe its output through a strict allowlist filter before it reaches the Agent. Do not rely on a denylist of secret field names. 5. Redact sensitive fields at the CLI serialization layer and add automated tests confirming that configuration and authentication commands cannot emit secrets. 6. Run the profile check once per session where possible instead of before every authenticated command. 7. Review the external `../_shared/preflight.md` dependency to ensure it does not independently disclose or transmit credential data. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/workflows.md:129
• Finding: Live Dual Investment Purchase Can Execute Without Final Explicit Confirmation<![CDATA[ ## Vulnerability Details **File Location**: `references/workflows.md`, lines 129–138 **Vulnerability Type**: Unsafe authorization flow for a live financial transaction **Risk Level**: High ### Vulnerable Code ```markdown 3. Explain settlement scenarios **before** user selects — fill in ALL placeholders with real values. Respond in the user's language. Example structure (CALL / 高卖): ``` You invest {sz} {notionalCcy} at target price ${strike}: ✅ Expiry price < ${strike} (not triggered — not sold): Receive {sz} × (1 + yield rate) {baseCcy} ⚠️ Expiry price ≥ ${strike} (triggered — sold at target price): Receive {sz} × {strike} × (1 + yield rate) {quoteCcy} Both principal and yield convert to {quoteCcy} The above APR is indicative; actual yield is locked at quote execution. ``` 4. After user selects product and confirms amount, execute `earn dcd quote-and-buy` immediately — quote and execution happen atomically, no separate confirmation step needed. Respond in the user's language. 5. After `quote-and-buy`: wait 3–5 seconds, then query `earn dcd orders` to confirm. Show locked-in APR and order state. ``` ### Technical Analysis `earn dcd quote-and-buy` is an atomic WRITE command that obtains a live quote and immediately places a real Dual Investment order. The workflow explicitly says that no separate confirmation is needed after the user selects a product and amount. This conflicts with the global control in `SKILL.md`, which states that all WRITE commands must present an operation summary and wait for explicit confirmation. Product selection or amount discussion is not necessarily informed authorization to execute the final live quote. The risk is amplified because: - Dual Investment does not support simulated mode. - The displayed APR is indicative and may change at execution. - Triggering can convert both principal and yield into another currency. - The operation is atomic, so the final quote cannot be revi ...[truncated 1477 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction stating that no separate confirmation is needed. 2. Require a final, explicit confirmation immediately before every `quote-and-buy` invocation. 3. The confirmation summary should include: - Product ID - Direction and product type - Investment amount and notional currency - Target or strike price - Expiry and settlement time - Indicative APR and the minimum acceptable execution yield - Both settlement outcomes - Lock-up and early-redemption restrictions - A clear statement that the operation uses real funds 4. Require an unambiguous response such as “Confirm purchase” after the summary. Product selection, amount entry, or phrases such as “just do it” should not count as confirmation. 5. Always supply `--minAnnualizedYield` based on the value approved by the user so the order is rejected if the execution quote deteriorates. 6. Generate a unique `--clOrdId` for idempotency and retain it until order status is verified. 7. Preserve the existing rule not to retry a timed-out WRITE operation. Query order status using the client order ID or order history before taking further action. 8. Revalidate product availability, balance, expiry, and amount immediately before displaying the final confirmation. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27
• Finding: Unpinned Global Installation of the Privileged OKX CLI<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 27–31 **Vulnerability Type**: Mutable third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code ```markdown ## Prerequisites 1. Install `okx` CLI: ```bash npm install -g @okx_ai/okx-trade-cli ``` ``` ### Technical Analysis The installation command omits a version and therefore resolves the package version associated with the registry's mutable default tag at installation time. This is inconsistent with the frontmatter, which identifies version `1.4.7` as the expected dependency. Consequently, the executable actually installed and run may differ from the version for which the Skill instructions were written or audited. Global npm installation also makes the binary available broadly in the user's environment and may execute package lifecycle scripts with the installing user's privileges. This CLI is especially sensitive because it is subsequently trusted with OAuth state, API-key profiles, account balances, and live financial WRITE operations. A compromised publisher account, malicious future release, registry compromise, or unexpected breaking update could therefore execute with access to valuable credentials and authenticated account operations. No evidence establishes that the named package or its current release is malicious. The vulnerability is the unsafe, mutable installation mechanism and the absence of integrity verification. ### Attack Path 1. The user follows the Skill's prerequisite command. 2. npm resolves the current default release of `@okx_ai/okx-trade-cli`, rather than the audited `1.4.7` release. 3. npm downloads the package and may execute its lifecycle scripts. 4. The globally installed `okx` binary is later used to initialize authentication or read an existing profile. 5. A compromised or unexpectedly altered package can access local files and environment data with the user's privileges. 6. It can potentially capture OKX creden ...[truncated 752 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the exact reviewed version: ```bash npm install -g @okx_ai/okx-trade-cli@1.4.7 ``` 2. Keep the installation command synchronized automatically with `metadata.version`. 3. Verify package integrity using a trusted lockfile, expected registry metadata, and a recorded integrity digest. 4. Verify publisher provenance and use npm provenance or signature verification where available. 5. Prefer an isolated project-local installation or a locked execution environment over `-g`. 6. Disable npm lifecycle scripts during installation when they are not required: ```bash npm install --ignore-scripts @okx_ai/okx-trade-cli@1.4.7 ``` If lifecycle scripts are required, review them before installation. 7. Validate the installed binary version before authentication or account access and stop if it differs from the audited version. 8. Apply an explicit dependency-update review process before changing the pinned release. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

- **Security:** Never ask users to paste API keys or secrets into chat.
- **Output:** Always pass `--json` to list/query commands and render results as a Markdown table — never paste raw terminal output.
- **Network errors:** If commands fail with a connection error, prompt user to check VPN: `curl -I https://www.okx.com`
- **Language:** Always respond in the user's language.

For number/time formatting and response structure conventions, read `{baseDir}/references/templates.md`.

• Confidence: 70% confidence
• Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

**NEVER expose raw state values** to the user — always translate using the table above.

**Display rules:**
- Render as Markdown table with columns: # · reqId · Currency · Amount · Rate · Term · Status · Accrued Interest · Create Time
- Format timestamps using `YYYY/M/D HH:MM`
- For `pending` orders, note that early redemption is available

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill description is extremely broad and includes generic phrases like idle funds, earning on funds, fixed deposit, and term deposit. This can cause the agent to route ordinary financial questions into a high-risk trading/earn skill, increasing the chance of unintended authenticated actions or advice in a sensitive financial context.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Global Notes

- **Security:** Never ask users to paste API keys or secrets into chat.
- **Output:** Always pass `--json` to list/query commands and render results as a Markdown table — never paste raw terminal output.
- **Network errors:** If commands fail with a connection error, prompt user to check VPN: `curl -I https://www.okx.com`
- **Language:** Always respond in the user's language.

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This section documents an immediate live purchase path for a financial product using `--profile live` and `quote-and-buy`, but it does not require an explicit user confirmation step or a clear warning that this is a write action affecting real funds. In an agentic setting, that omission is dangerous because a user’s exploratory query could be translated into a live trade, leading to unintended subscription of Dual Investment products with locked terms and settlement currency conversion risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The redemption flow is described as automatically fetching a fresh quote and immediately executing, yet it lacks a mandatory warning that this is an irreversible write action that can realize gains or losses. Because early redemption changes a live financial position and may occur during a limited redemption window, an agent could unintentionally liquidate a user’s order without informed consent.

Behavior Manipulation

Medium

• Category: Prompt Injection

Content

okx --profile live earn savings set-rate --ccy USDT --rate 0.01
```

`--rate` is the user's minimum matching threshold — funds are lent only when the market lending rate ≥ this value. The actual yield is always `lendingRate`. Never tell users that lowering their minimum rate reduces earnings — this is incorrect.

---

• Confidence: 75% confidence
• Finding: Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The template hard-codes a fallback to UTC+8 when the user's timezone is unknown, which can cause displayed expiry, purchase, settlement, or redemption times to be shifted relative to the user's actual locale. In a financial earn product context, incorrect time presentation can mislead users about deadlines or status timing, increasing the risk of mistaken subscriptions, missed expiries, or premature assumptions about fund availability.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The DCD subscription workflow explicitly says to execute `quote-and-buy` immediately after the user selects a product and amount, with no separate final confirmation step. Because Dual Investment is a complex, irreversible financial product with settlement and conversion risk, skipping an explicit pre-execution confirmation materially increases the chance of unintended trades or prompt-induced fund commitment.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The manifest describes using the skill to check balances, browse projects, subscribe/redeem products, and manage earn settings via the OKX CLI. This section adds a persistent scheduled monitoring task with periodic execution and user notifications, which is an automation capability not explicitly justified by the stated transactional/interactive earn-management scope.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The manifest mentions browsing flash-earn projects and managing earn products, but this workflow implements hourly polling, deduplication of previously notified project IDs, and proactive notifications. That behavior is a distinct monitoring/alerting capability rather than a direct, on-demand earn-management action described in the manifest.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: This section describes a recurring task that repeatedly queries live balances, earn positions, and account data every 4 hours, but the markdown does not clearly warn the user that ongoing automated access to account information will continue until stopped. For markdown files, omitted warnings about repeated access to user financial data can be a missing user warning.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:109