Security audit

OKX API

Security checks across malware telemetry and agentic risk

Overview

This is a coherent OKX trading skill, but it includes live financial account access plus an unrelated git-push permission, so it needs careful review before use.

Install only if you intentionally want an agent to access OKX. Use demo mode first, prefer read-only or least-privilege API keys, disable withdrawals, consider IP allowlisting, remove the unrelated .claude git-push permission, and require manual confirmation before any live order, amendment, or cancellation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill instructs the agent to use environment-injected credentials and make outbound network requests to OKX, but no explicit permissions are declared. That creates a trust and review gap: a caller may not realize the skill can access secrets and interact with external trading infrastructure, increasing the risk of unintended secret use or live account actions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 84% confidence
Finding: The documented behavior goes beyond the stated description by including WebSocket connectivity, including private channels and live order-update streaming. This mismatch can mislead reviewers and users about the skill's true runtime capabilities, especially because private streaming channels can expose sensitive account activity and maintain ongoing authenticated connections.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The local settings explicitly allow execution of `git push origin main`, which grants the skill the ability to modify and publish repository state to the primary branch. That capability is unrelated to querying balances, placing orders, or otherwise interacting with the OKX API, so it materially expands the attack surface and could be abused to exfiltrate changes, backdoor code, or tamper with project history through unauthorized pushes.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README prominently advertises account management and order placement/cancellation, but does not provide an explicit warning that these actions may execute against live funds and create real financial loss. In an agent-skill context, this omission is materially risky because users may assume the agent is operating safely or in demo mode by default, increasing the chance of unintended live trades.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README explicitly states the skill can query balances and place authenticated OKX orders, but it does not prominently warn that actions may affect a live exchange account and cause irreversible financial loss. In an agent-skill context, this is more dangerous than ordinary API docs because users may let an autonomous agent execute trades with injected credentials.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The configuration section instructs users to store OKX API secrets in a global OpenClaw config and notes they are injected into every agent session, but it does not warn about credential exposure, over-broad scope, or the risk of unrelated skills/prompts accessing those secrets. In an agent ecosystem, broad secret injection materially increases the blast radius of prompt injection, logging leaks, or accidental disclosure.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explains how to place and cancel live exchange orders but does not require a prominent warning about real-money trading risk or a mandatory live-vs-demo confirmation. In this context, that omission is especially dangerous because the same credential path supports both sandbox and live mode, so a misconfigured environment or user misunderstanding could trigger irreversible financial trades.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The document explicitly recommends printing the pre-sign string for debugging but provides no warning to avoid logging sensitive authentication material or to redact secrets. In an API-authentication skill for a crypto exchange, users commonly add adjacent debug logging for headers, keys, passphrases, or request bodies, which can leak credentials into terminal history, application logs, CI logs, or observability systems and enable account compromise.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This reference documents authenticated endpoints that can place, amend, and cancel live OKX orders, but it does not warn that these actions affect real funds and open positions. In an agent skill context, omission of such guardrails can lead the model or user to treat these as routine data operations, increasing the chance of unintended trades, cancellations, or modifications with financial loss.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.