okx-cex-trade

• Outcome: Review
• Latest audit: Sep 23, 2026 · 1:28 PM UTC
• Version: 1.4.8

Overview

This is a disclosed OKX trading skill, but it needs review because it can execute live financial trades and includes some advisory and automatic account-data behavior beyond simple order execution.

Install only if you intend to let an agent operate an authenticated OKX trading CLI. Prefer demo mode first, verify the active profile before every trade, and require explicit confirmation for any order, cancellation, leverage change, or position close. Treat any directional recommendation as informational only and make the trading decision yourself.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/event-workflows.md (reported line 3)May include surrounding context.

md

# Event Contract Workflows — Multi-Step Trading Scenarios

> **Display rule**: When presenting tool results to users, always use user-facing labels
> (e.g., "Order number", "Contract", "Fill price"), not raw API field names
> (e.g., `ordId`, `instId`, `fillPx`).

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill includes swap positions and references to account position queries even though its manifest explicitly says not to use this skill for portfolio/account-balance tasks. In a high-risk trading context, this broadens the operational scope and can expose more account state than the user intended, weakening least-privilege routing and increasing the chance of incorrect skill selection.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 392)May include surrounding context.

md

For cross-skill workflows and step-by-step examples, read `{baseDir}/references/workflows.md`.

### Step 2 — Confirm profile, then confirm write parameters

**Read commands** (orders, positions, fills, get, get-leverage, algo orders): run immediately.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill instructs use of okx account config to inspect account level, which extends beyond the declared trading/order-management scope into broader account-configuration access. Even as a read-only diagnostic, this expands capability surface and can disclose sensitive account settings or encourage the agent to operate outside its advertised boundaries.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 415)May include surrounding context.

md

### Error-suggested remediation safeguard

When an OKX API error message suggests a fix that involves **write operations** (cancel orders, close positions, stop bots/strategies, transfer funds, etc.), you **MUST NOT** automatically execute those actions. Instead:

1. **Report** the error and its suggestion to the user verbatim
2. **Diagnose** — run read-only queries to identify what is blocking (e.g., `algo-orders --status pending`, `positions`, `bot grid-orders --status active`)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This workflow instructs the agent to analyze market candles, recommend UP or DOWN, and present a confidence level. That expands the skill from trade execution into investment-advisory behavior, which can cause the agent to influence trading decisions rather than merely carry out explicit user intent. In a trading skill with order placement capability, that additional discretion materially increases risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This section directs the agent to query account positions, compute PnL context, and display portfolio-like information even though the manifest says account balance belongs to a different skill and this skill is for trading workflows. Mixing portfolio/account access into an order-execution skill broadens data access and increases the chance of unauthorized or unexpected exposure of sensitive account state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The workflow tells the agent to automatically perform account/market lookups for expired positions without first warning the user or obtaining explicit consent for additional account-data access. In a financial context, silent retrieval of account-linked position and settlement information can violate least surprise and expose sensitive trading data beyond the immediate user request.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The instruction to 'immediately run without asking' authorizes autonomous follow-up actions based on inferred expiry state. Even though the follow-up is read-only, it still expands the agent's discretion in a sensitive financial/account context and can lead to unexpected access patterns or disclosure of settlement details the user did not explicitly request.

Content

Scanner excerpt · references/event-workflows.md (reported line 135)May include surrounding context.

• Infer expiry from the instrument ID (instId, API field):
  • price_above / price_once_touch: YYMMDD-HHMM → e.g. 260320-1600 = 2026-03-20 16:00 UTC+8
  • price_up_down: YYMMDD-START-END → expiry is the END time
• If expired → immediately run without asking:

  text

  okx event markets <seriesId> --state expired
  

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/event-workflows.md (reported line 175)May include surrounding context.

User: "Cancel order EVT-ORDER-001" / "Cancel my order 800000024"

okx event cancel requires both the instrument ID and Order number. If the user only provides the Order number, look up the instrument ID first — never ask the user for it.

text

Step 1: okx event orders --status open

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file gives conflicting guidance about option TP/SL management: one section documents okx option algo amend for modifying attached TP/SL, while the edge-cases section says 'No TP/SL algo on options' and that swap/spot algo commands do not apply. In a trading skill, this ambiguity can cause an agent or operator to mismanage protective orders, leaving positions unprotected or issuing incorrect commands during live trading.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This reference documents high-impact trading operations such as placing, amending, and canceling orders, setting leverage, and configuring TP/SL without any explicit caution that these actions can immediately affect real funds or create leveraged exposure. In an agent-facing skill, omission of account-impact warnings increases the chance of unintended or insufficiently confirmed execution, especially because the skill is designed for direct order placement on a live exchange.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The close-position section states that the command closes the entire position at market price, but it does not prominently warn that this is an irreversible live-trading action that can immediately liquidate the full position and realize P&L. Given this skill’s context—an execution-capable trading agent handling leveraged swap products—the lack of a strong caution materially increases the risk of accidental full exits, slippage, and losses.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This file contains concrete examples for placing live swap and algo orders, including TP/SL, trailing, trigger, chase, iceberg, and TWAP orders, without an explicit warning that these actions may execute real-money trades on a live exchange. In an agent skill that is specifically designed to accept natural-language trading instructions and requires API credentials, omission of a clear live-trading risk warning increases the chance that an agent or user treats examples as harmless templates and submits unintended financial transactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file documents tools that can place orders, close positions, cancel or amend orders, and change leverage, all of which can materially affect user funds and positions. While later sections include some execution safety rules, the file does not clearly warn users up front that using these tools can execute real trading actions with financial risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The workflow shows a bulk cancellation pattern for open spot orders but does not require an explicit user confirmation step or warn that canceling all open orders is immediate and may remove protective or strategically staged orders. In a trading skill, destructive trading actions are high-risk because they can materially change market exposure and cannot be undone once submitted.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The instructions require the agent to interpret Chinese terms and, when mode is unclear, ask the user "Live (实盘) or Demo (模拟盘)?". This imposes bilingual/Chinese wording in user-facing responses without an explicit opt-in or language-preference check, which can violate a language/locale choice policy.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 422)May include surrounding context.

md

3. **Present findings** — show the user what was found and which specific items would need to be cancelled/closed/stopped
4. **Wait for explicit confirmation** before executing any remediation

This applies to all error codes whose messages suggest destructive actions, including but not limited to:
- Set-leverage blocked by pending algo orders or active bots
- Account setting changes requiring order/position/strategy cleanup (e.g., error codes 59000, 59002, 59007)
- Margin mode switches requiring position closure

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Telling the agent to run okx list-tools --json enumerates all CLI capabilities, including commands outside this skill's intended purpose. Capability discovery can facilitate scope creep, accidental invocation of unrelated high-risk operations, and violation of principle-of-least-authority in a trading environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The example trigger "What's coming up in event contracts?" is clear, but pairing it with the broader phrase "Are there any BTC contracts opening soon?" without explicit boundaries leaves activation scope somewhat open-ended for any generic request about what is "coming up." The file does not provide exclusion conditions or negative examples to clarify when this workflow should not be invoked.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

L116 tells the agent to run okx account config to inspect acctLv. The manifest narrowly scopes this skill to trading actions and explicitly excludes other account-oriented uses, so directing use of an account command extends behavior beyond pure order/position operations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

Line L329 instructs 'Never automatically cancel algo orders or stop bots', but this reference file also documents direct cancellation capabilities such as okx futures algo cancel. While the statement is framed as operator guidance rather than executable logic, it creates a mild intent/documentation inconsistency within the documented behavior surface.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The document includes Chinese-only user prompts and warnings in some sections, while the rest of the skill is primarily in English. This can amount to a language/locale policy issue because the skill implicitly switches languages without documenting user choice or opt-in.

Content

No source excerpt is available for this finding.