Security audit

okx-sentiment-tracker

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed OKX news and sentiment helper, but it also includes under-disclosed workflows that can read account positions and balances and give personalized trading-risk suggestions.

Review this skill before installing if you use OKX account credentials. Its news and sentiment commands are read-only, but some workflows may cause an agent to access your live-profile positions and balances and produce personalized trading-risk suggestions; only use those workflows when you intentionally want portfolio-aware analysis.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger description is extremely broad, covering generic phrases like 'latest news', 'market update', and macro-data terms, which can cause this skill to activate for requests outside its intended niche. Over-broad activation can route users into a credentialed external tool unnecessarily, increasing the chance of unintended data access, confusion, or policy bypass through wrong-skill selection.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly instructs the agent to perform general web searches when OKX results are sparse, expanding data access beyond the declared OKX news/sentiment scope. This can bypass user expectations, introduce untrusted external content into responses, and weaken control boundaries that would otherwise limit the agent to a specific API-backed data source.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file states that all news and sentiment commands are read-only, but later instructs account-specific analysis and actionable suggestions tied to positions. This inconsistency can mislead reviewers, orchestrators, or users about the real capability and data sensitivity of the workflow, weakening guardrails and informed consent.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This workflow expands a read-oriented news/sentiment skill into portfolio-aware analysis by instructing the agent to fetch user positions and balances, then generate actionable position advice. That broadens data access and decision support beyond the skill's stated scope, increasing the chance of unnecessary exposure of sensitive financial data and unsafe cross-skill behavior.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The workflow explicitly tells the agent to pull user positions and balances and then map macro signals into actionable recommendations such as take-profit, stop-loss, leverage reduction, or hold. Even without directly placing trades, this combines sensitive financial data access with personalized investment guidance, creating privacy, compliance, and user-harm risks if the analysis is wrong, overbroad, or triggered without clear consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction states that language is inferred from the user's message and maps automatically to '--lang zh-CN' or '--lang en-US'. This imposes a locale choice without explicit user opt-in or an offered alternative, which can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Line L369 includes the Chinese example phrase "BTC 受哪些宏观数据冲击" alongside English, indicating language-specific invocation guidance. The file does not state that the skill is region-specific or that users may choose their preferred language, so this can conflict with language/locale neutrality expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.