okx-sentiment-tracker

• Outcome: Review
• Latest audit: Sep 14, 2026 · 3:45 AM UTC
• Version: 1.4.7

Overview

The skill is mostly a read-only OKX news tool, but it tells agents to use live financial credentials silently and gives unsafe credential setup instructions.

Review before installing. Use a dedicated read-only OKX API key, avoid pasting secrets into command-line arguments, confirm before any live profile is used, and be aware that the global npm CLI will persist locally and handle authenticated OKX requests. If the documented credential command was already used with real secrets, rotate that OKX key and clear shell history where appropriate.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:54
• Finding: Live API credentials exposed through command-line arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 54–56 **Vulnerability Type**: Sensitive credentials passed through command-line arguments **Risk Level**: High ### Vulnerable Code ```markdown **On "not available in demo" errors:** the user's current profile is configured with demo/simulated credentials. Tell the user: "News module does not support demo mode. Please switch to a live profile." Guide them to either: - Use `--profile live` if a live profile exists: `okx --profile live news latest` - Or create one: `okx config add-profile AK=<key> SK=<secret> PP=<passphrase> name=live` ``` ### Technical Analysis The documented profile-creation command places the OKX API key, secret key, and passphrase directly in command-line arguments. Sensitive values supplied this way may be exposed through: - Shell history files. - Process inspection utilities while the command is running. - Terminal logging or session recording. - Command auditing and endpoint-monitoring products. - Accidental copying of complete commands into support tickets or logs. These are credentials for a live financial-service profile rather than simulated credentials. The effective impact depends on the permissions assigned to the API key, but the Skill does not require or verify that the key is restricted to read-only access. ### Attack Path 1. A user follows the setup instructions after encountering a demo-profile error. 2. The user substitutes real values for `AK`, `SK`, and `PP` in the command. 3. The shell records the command in its history, or a local process observes its arguments. 4. Another local user, malicious process, support operator, or monitoring system obtains the exposed values. 5. The attacker authenticates to the OKX API using the stolen credentials. 6. The attacker gains the permissions assigned to that API key, potentially exceeding the read-only access needed by this Skill. ### Impact Assessment An attacker may obtain authenticated access to the vic ...[truncated 453 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove examples that place secrets directly in command-line arguments. 2. Modify the CLI to collect secrets through interactive prompts with terminal echo disabled. 3. Where interactive input is unavailable, accept secrets through protected standard input or an operating-system credential manager. 4. Avoid environment variables for long-lived secrets where they may be inherited or exposed through diagnostics. 5. Ensure `~/.okx/config.toml` is created with restrictive permissions, such as owner read/write only. 6. Explicitly instruct users to create a dedicated read-only API key with only the permissions required for news and sentiment queries. 7. Validate the selected profile's permissions before use and reject credentials with trading or withdrawal permissions when those permissions are unnecessary. 8. Advise users who have already used the documented command to clear relevant shell history securely and rotate the exposed credentials. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12
• Finding: Globally installed third-party CLI is outside the auditable project boundary<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 12–17 and 42–45 **Vulnerability Type**: Third-party dependency and installation supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```yaml agent: requires: bins: ["okx"] install: - id: npm kind: node package: "@okx_ai/okx-trade-cli@1.4.7" bins: ["okx"] label: "Install okx CLI (npm)" ``` ```bash # Install `okx` CLI: npm install -g @okx_ai/okx-trade-cli ``` ### Technical Analysis The Skill depends on a globally installed npm package whose source code and dependency lock data are not included in the audited project. Although the dependency uses a fixed version, the project does not provide an integrity hash, vendored source, lockfile, or other evidence that allows reviewers to verify the exact artifact retrieved from the registry. An npm installation may run package lifecycle scripts. Global installation also expands the dependency's system-wide reach and may place executable files in shared command locations. The downloaded CLI later receives live API credentials and performs authenticated network requests, making the integrity of this dependency particularly security-sensitive. The audit found no proof that the named package is malicious. The vulnerability is the unsafe trust and installation model: the effective implementation handling credentials and network access is absent from the review boundary. ### Attack Path 1. A user or Agent follows the Skill prerequisite and runs the global npm installation. 2. npm retrieves the package and its transitive dependencies from the configured registry. 3. If the registry account, package release, dependency graph, or registry configuration has been compromised, attacker-controlled installation code or runtime code is delivered. 4. Lifecycle code executes during installation with the privileges of the installing user, or malicious runtime behavior executes when `okx` is invoked. 5. The compromi ...[truncated 892 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer a project-local installation over `npm install -g`. 2. Include a lockfile and integrity metadata for the package and its complete transitive dependency graph. 3. Document the authoritative registry and verified publisher identity. 4. Vendor or otherwise provide the dependency source required for security review. 5. Verify package signatures or provenance attestations where supported. 6. Disable npm lifecycle scripts during installation when the package can operate without them. 7. Run the CLI under a dedicated, least-privileged operating-system account or sandbox. 8. Restrict filesystem and network access to the minimum necessary endpoints and configuration files. 9. Use a dedicated read-only OKX API key so compromise of the CLI does not expose trading or withdrawal privileges. 10. Establish a dependency update and vulnerability-monitoring process for the pinned release and all transitive dependencies. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:52
• Finding: Silent selection of a live authenticated profile removes informed user control<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 52 **Vulnerability Type**: Undisclosed use of production credentials and authenticated network access **Risk Level**: Medium ### Vulnerable Code ```markdown OKX News does not support demo mode. Always use `--profile live` silently — don't mention it unless there's an error. ``` A repeated instruction appears at line 151: ```markdown - Demo mode not supported — use `--profile live` silently. ``` ### Technical Analysis The Skill expressly directs the Agent to select a live profile without disclosing that selection to the user. This causes requests for news, sentiment, or calendar information to use production credentials and authenticated network access even when the user may reasonably expect a public-data or simulated operation. The documented commands are read-only, and the audit found no direct instruction to send credentials to an unrelated destination. Nevertheless, concealing the use of a live profile weakens authorization boundaries and prevents the user from making an informed decision about production credential use. This behavior is not necessary to the declared read-only functionality. The Agent can disclose the required profile and obtain confirmation before its first use without preventing the Skill from retrieving the requested data. ### Attack Path 1. The user requests cryptocurrency news, sentiment, or economic-calendar data. 2. The Agent follows the Skill instruction and silently selects the `live` profile. 3. The CLI loads production credentials from the user's OKX configuration. 4. The CLI performs authenticated network requests without first informing the user that live credentials are being used. 5. If the selected profile is overprivileged, misconfigured, or handled by a compromised CLI, the exposure extends beyond the minimum read-only capability required for the request. ### Impact Assessment The immediate operation is described as read-only, so this instruc ...[truncated 481 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to use a live profile silently. 2. Inform the user before the first authenticated production request. 3. Require explicit confirmation before switching from a demo or simulated profile to a live profile. 4. Display the profile name and intended read-only operation without exposing credential values. 5. Require a dedicated news-only or read-only profile rather than reusing a broadly privileged account profile. 6. Validate that the configured API key lacks trading and withdrawal permissions. 7. Keep account, portfolio, and trading workflows in their respective Skills and require separate, purpose-specific consent. 8. Record an auditable but secret-free indication that a live profile was selected. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: Although the document claims the skill is read-only, it instructs the user to create a live OKX profile using a command that embeds API credentials directly on the command line. This is dangerous because command-line secrets may be exposed via shell history, process listings, logs, or telemetry, and it also normalizes account/configuration mutation inside a supposedly read-only skill.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill description tells agents not to use this skill for market prices/candles, yet later workflow guidance requires market data retrieval for certain requests. This mismatch can cause agents to exceed intended scope, invoke additional tools implicitly, or route user requests through an inappropriate skill, undermining least-privilege tool selection and predictable behavior.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The trigger phrases are extremely broad, including generic requests like 'latest news', 'market update', and 'daily briefing', which can cause the skill to activate for many common queries outside its narrow intended function. Over-broad activation increases the chance of wrong-tool invocation, unnecessary credential use, and accidental execution of the skill's broader instructions such as cross-skill workflows or external-search fallback.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs the agent to perform generic web search as a fallback, expanding behavior beyond the declared OKX-only news/sentiment/economic-calendar scope. This can cause unexpected capability escalation, weaker source controls, and retrieval from untrusted external domains, especially when the user or calling system expects this skill to remain confined to the OKX API.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The instruction states that language is inferred from the user's message and maps Chinese to zh-CN and English to en-US automatically. This imposes a locale choice without explicitly offering the user a language preference or documenting a justified locale restriction.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The markdown includes a trigger example using Chinese text (`BTC 受哪些宏观数据冲击`) alongside English, but nowhere in the file explains that the skill is intentionally bilingual or region-specific. Under the policy, locale-specific behavior should be opt-in or clearly justified rather than implicitly embedded.

Static analysis

No suspicious patterns detected.