okx-cex-skill-mp

• Outcome: Review
• Latest audit: Sep 23, 2026 · 1:26 PM UTC
• Version: 1.4.8

Overview

The skill is a coherent marketplace manager, but installing third-party skills across local agents with an unpinned install step and an optional verification bypass is high-impact enough to require review.

Review before installing. This skill is not clearly malicious, but it can add, overwrite, or remove third-party skills across multiple local agents. Avoid `--force` unless you have independently verified the package, and treat installed marketplace skills like local software because they can affect future agent behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md

- `SKILL.md` — the skill's main instruction file

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description contains very broad routing language covering generic requests like searching, installing, downloading, updating, verifying, and managing skills. Over-broad activation can cause the agent to invoke this high-privilege skill in more contexts than necessary, increasing the chance of unintended downloads, installs, or exposure to third-party content.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The skill states it runs npx skills add during installation, but does not pin the package name or version being executed. Unpinned npx execution can fetch whatever package currently resolves under that name, creating a supply-chain execution path on the user's machine with local privileges.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The skill explicitly documents a --force mode that bypasses signature verification for third-party skills, which defeats the primary integrity control protecting users from malicious or tampered packages. In this context, the danger is elevated because installed skills run locally with the agent's full permissions, so bypassing verification can directly enable execution of untrusted code/instructions.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

4. Runs npx skills add to install to all locally detected agents
5. Records the installation (including verification status) in ~/.okx/skills/registry.json

Force-install (bypass verification):

bash

okx skill add grid-premium --force

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

This line documents failure of npx skills add, reinforcing that the install flow depends on an unpinned npx command. While this line is in error handling rather than execution logic, it still reflects a real unsafe dependency pattern elsewhere in the skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

This line documents failure of npx skills add, reinforcing that the install flow depends on an unpinned npx command. While this line is in error handling rather than execution logic, it still reflects a real unsafe dependency pattern elsewhere in the skill.

Content

No source excerpt is available for this finding.