Security audit
okx-cex-portfolio
Security checks across malware telemetry and agentic risk
Overview
This OKX account skill is mostly purpose-aligned, but it handles financial credentials and installs extra executable code in ways users should review before enabling.
Review this before installing because it can access sensitive OKX account data and perform internal fund transfers or position-mode changes. Use a dedicated OKX sub-account with limited permissions, test in demo mode first, and avoid letting agents display or summarize `okx config show --json` output because it may contain API secrets. Also be aware the npm install may download and keep an additional OKX executable under your home directory.
SkillSpector
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
58/58 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.