okx-cex-smartmoney

• Outcome: Review
• Latest audit: Sep 14, 2026 · 3:45 AM UTC
• Version: 1.4.7

Overview

The skill appears to provide read-only OKX smart-money analytics, but it relies on a global external npm CLI and inspects local OKX credential profile output without clear redaction safeguards.

Review this skill before installing. Use it only if you trust the external OKX npm CLI package, and prefer least-privilege OKX credentials. Do not use API keys with withdrawal or unnecessary trading permissions, confirm that okx config show redacts secrets before letting an agent run it, and avoid sharing raw authentication or profile command output in chat or logs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11
• Finding: Unauditable Globally Installed Third-Party CLI Dependency## Vulnerability Details **File Location**: `SKILL.md:11-17` **Vulnerability Type**: Supply-chain exposure through a globally installed npm dependency **Risk Level**: Medium ### Vulnerable Code Snippet ```yaml metadata: author: okx version: "1.4.7" homepage: "https://www.okx.com" agent: requires: bins: ["okx"] install: - id: npm kind: node package: "@okx_ai/okx-trade-cli@1.4.7" bins: ["okx"] label: "Install okx CLI (npm)" ``` The installation instruction is also presented to users in `SKILL.md:25-31`: ```bash npm install -g @okx_ai/okx-trade-cli ``` ### Technical Analysis The Skill depends on `@okx_ai/okx-trade-cli@1.4.7`, which is installed globally from the npm registry. Pinning the version reduces unintentional version drift, and the package namespace is consistent with the declared vendor. However, the reviewed artifact does not contain the package source, a lockfile, a cryptographic integrity value, or other verifiable provenance information. npm packages may execute lifecycle scripts during installation. A global installation therefore allows the dependency's installation logic to run with the privileges of the user executing npm and to place commands in globally accessible binary locations. The audit cannot verify the CLI's installation-time behavior, runtime network destinations, or credential handling because its implementation is absent from the artifact. This is a supply-chain risk rather than evidence that the named package is currently malicious. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the registry delivery path, or the package release process. 2. A user or agent follows the Skill's installation instructions. 3. npm downloads the externally maintained package and may execute its lifecycle scripts. 4. The compromised code runs with the installing user's privileges. 5. It can ...[truncated 713 chars]
• Remediation: ## Remediation Suggestions 1. Include auditable CLI source or provide a reproducible, independently verifiable build. 2. Publish and verify package provenance, signatures, and a cryptographic integrity digest before installation. 3. Use a lockfile or equivalent immutable dependency manifest. 4. Avoid global installation. Install the CLI in an isolated project directory, container, or restricted execution environment. 5. Disable npm lifecycle scripts where compatible, such as with `--ignore-scripts`, and separately review any scripts required for operation. 6. Execute the CLI as a dedicated, least-privileged user with restricted filesystem and network access. 7. Validate the installed binary's path and checksum before invoking it. 8. Document the expected network endpoints and credential-access behavior so deployments can enforce an allowlist.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:38
• Finding: Credential Profile Inspection May Expose API Key Material## Vulnerability Details **File Location**: `SKILL.md:38-48` **Vulnerability Type**: Potential plaintext sensitive-data exposure through command output **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## Credential & Profile Check Run **both** commands before any authenticated command — the `apiKey` field from `okx auth status --json` is the auth-binary's internal state and is always `false` regardless of whether `~/.okx/config.toml` has an API-key profile. `okx config show --json` is the only authoritative source for API-key presence. The auth method is detected during [preflight](../_shared/preflight.md) Step 2 and remembered for the session. ```bash okx config show --json # reveals API-key profiles (TOML config) okx auth status --json # reveals OAuth session state (auth-binary state) ``` Apply **in this order** — first match wins: - `config show --json` has any profile with a non-empty `api_key` field → **API Key mode**. Proceed. ``` ### Technical Analysis The Skill mandates running `okx config show --json` before authenticated operations and determines authentication mode by examining whether an `api_key` field is non-empty. The documentation does not establish that the command always masks the field, nor does it direct the agent to suppress, sanitize, or immediately discard the output. The separate warning not to accept credentials in chat is beneficial, but it does not address credentials exposed through terminal output, tool results, agent context, telemetry, transcripts, or diagnostic logs. If the installed CLI emits the full key rather than a redacted value, the mandatory check can move sensitive data from a local configuration file into additional systems. The artifact contains no evidence of intentional external transmission. The issue is inadequate output minimization and redaction around a credential-bearing configuration command. ### Attack Path 1. A user configures an ...[truncated 1057 chars]
• Remediation: ## Remediation Suggestions 1. Replace `config show --json` with a dedicated status command that returns only profile names, environment type, and a boolean such as `has_api_key`. 2. Ensure secret values, passphrases, tokens, and API keys are redacted at the CLI serialization layer before any output is produced. 3. Explicitly instruct the agent never to print, quote, persist, summarize, or relay raw configuration output. 4. Parse the minimum required boolean locally and discard the raw output immediately. 5. Prevent credential-check output from entering telemetry, shell history, debug logs, model context, or user-visible transcripts. 6. Add automated tests confirming that configuration and authentication status commands cannot expose complete or partially reusable credentials. 7. Recommend least-privilege API profiles, IP allowlisting, restricted trading or withdrawal permissions, and regular key rotation. 8. Package and audit the referenced preflight instructions so credential-handling behavior is fully reviewable.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

- **Security:** Never ask users to paste API keys or secrets into chat.
- **Output:** Always pass `--json` to list/query commands and render results as a Markdown table — never paste raw terminal output.
- **Network errors:** If commands fail with a connection error, prompt user to check VPN: `curl -I https://www.okx.com`
- **Language:** Always respond in the user's language.
- **Time inputs:** `signal-trend-by-{filter,trader}` take an optional `--asOfTime <yyyyMMddHH>` anchor (10-digit UTC hour); omit to use the current UTC hour. `--limit` controls how many buckets are returned ending at that anchor. `signal-overview-by-{filter,trader}` takes no time input — handler always uses the current hour.

For number/time formatting and response structure conventions, read `{baseDir}/references/templates.md`.

• Confidence: 70% confidence
• Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### Step 2 — Execute and present

All commands are READ-only — no confirmation needed. Always pass `--json` and render results as Markdown tables.

For multi-step workflows (recommend traders then drill down, signal analysis with context), read `{baseDir}/references/workflows.md`.

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Global Notes

- **Security:** Never ask users to paste API keys or secrets into chat.
- **Output:** Always pass `--json` to list/query commands and render results as a Markdown table — never paste raw terminal output.
- **Network errors:** If commands fail with a connection error, prompt user to check VPN: `curl -I https://www.okx.com`
- **Language:** Always respond in the user's language.

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: This markdown file documents user utterances as activation examples, and phrases like "top performers this month" are broad enough to occur in general discussion outside a clearly bounded OKX smart-money context. The file does not provide explicit trigger scope, exclusion conditions, or negative examples to distinguish when this workflow should activate versus when it should not.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: Phrases like "show me trader X" and similar examples elsewhere in the document are generic requests that could refer to many contexts, not specifically this skill. Without explicit context restrictions, these examples may cause unintended invocation collisions with other trading or lookup skills.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The formatting instruction explicitly mandates converting timestamps to the user's timezone. This is a locale-related constraint expressed in natural language, and the file does not indicate that the user can choose a different timezone or opt out of the conversion.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The field description for `sz` uses Chinese terms (`币`, `张`) inline in otherwise English documentation. This imposes a mixed-language locale expectation without any user choice or note that multilingual output is intentional, which can violate language/locale policy requirements.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: Throughout the file, user examples are consistently framed as Chinese/English bilingual phrases, but there is no statement that language is user-selectable or that the skill supports other locales. This can be interpreted as a locale/language constraint that is not explicitly optional or justified.

Static analysis

No suspicious patterns detected.