Security audit

okx-outcomes

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent OKX Outcomes trading skill, but it should be reviewed because it combines financial trading authority with an unverified curl-to-shell installer.

Install only if you trust the OKX Outcomes CLI source and are comfortable granting local OAuth and signing-key access for OKX Outcomes trading. Prefer a signed or versioned release with checksum verification instead of running the raw GitHub curl-to-sh installer, and always verify order details before replying with the required confirmation word.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The recovery workflow tells the agent/user to install software by piping a remotely fetched script directly into `sh`. This creates a supply-chain and arbitrary code execution risk: if the remote script, hosting path, network path, or repository is compromised, the agent may facilitate execution of attacker-controlled shell commands on the user's machine.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The installation workflow explicitly recommends `curl -fsSL ... | sh` with no warning, review step, checksum validation, or version pinning. This normalizes execution of untrusted remote content and can result in immediate arbitrary command execution if the upstream script or delivery path is tampered with.

External Script Fetching

Low

Category: Supply Chain
Content: # 2. Outcomes binary # macOS / Linux: curl -fsSL https://raw.githubusercontent.com/okx/outcomes-cli/main/install.sh | sh # Windows: download okx-outcomes.exe from https://github.com/okx/outcomes-cli/releases # and place it on your PATH.
Confidence: 99% confidence
Finding: The skill instructs users to install the outcomes binary by piping a remote script directly into the shell. This pattern is dangerous because any compromise of the GitHub source, maintainer account, transport path, or referenced script can immediately lead to arbitrary code execution on the host running the command.

External Script Fetching

Low

Category: Supply Chain
Content: ## Edge Cases - **`okx-outcomes` not in PATH**: wrapper prints install hint and exits 127. Tell the user to run `curl -fsSL https://raw.githubusercontent.com/okx/outcomes-cli/main/install.sh | sh`. - **Signing wallet missing**: any `clob create-order` / `market-order` / `ctf *` will fail. Run `okx outcomes setup bind --json` (agent-runnable), relay the **short link** (`deeplink` field, `https://okx.com/ul/3OauBX?eoa=…&uid=…`), and have the user open it (tap on phone → OKX app, or copy into a browser); if the link won't open, have them copy the wallet address and bind it manually in the OKX app (**Outcomes → Profile → Settings → API Bind Wallet**) — never ask for the key in chat. - **Asset id vs market id mix-up**: the most common error class. `clob price/book/create-order/market-order` need `assetId`; `ctf *` and `account trades --market` need `marketId`. When unsure, run `event-markets <eventId>` first — its output lists both. - **`--tif gtd` without `--expiry`**: rejected client-side. Pair them or default to `gtc`.
Confidence: 99% confidence
Finding: The edge-case guidance repeats the same unsafe install command that fetches and executes a remote script in one step. Repetition increases the chance that an agent or user will follow it without verification, again exposing the environment to arbitrary code execution if the remote content is tampered with.

Chaining Abuse

High

Category: Tool Misuse
Content: # 2. Outcomes binary # macOS / Linux: curl -fsSL https://raw.githubusercontent.com/okx/outcomes-cli/main/install.sh | sh # Windows: download okx-outcomes.exe from https://github.com/okx/outcomes-cli/releases # and place it on your PATH.
Confidence: 99% confidence
Finding: The `| sh` construct is a classic dangerous chaining pattern because it takes untrusted network content and immediately executes it. In the context of an agent skill that may relay or automate commands, this materially increases the chance of turning documentation into a direct remote-code-execution path.

Chaining Abuse

High

Category: Tool Misuse
Content: sh --version 2. Install prebuilt binary from GitHub Releases: curl -fsSL https://raw.githubusercontent.com/okx/outcomes-cli/main/install.sh | sh 3. Verify: okx-outcomes --version
Confidence: 98% confidence
Finding: The `| sh` pattern is a direct command-chaining mechanism that takes network-fetched content and executes it immediately. In a skill intended for trading workflows, this is especially dangerous because it conditions the agent to bridge a remote fetch into code execution on the user's system, creating a high-risk path for compromise unrelated to normal market operations.

Static analysis

No suspicious patterns detected.