{"data":{"skill":{"slug":"okx-okx-activity","name":"okx-activity","icon":"📦","repo":"https://github.com/okx/onchainos-skills/tree/230f74137889420507e84706ab99204e71ddcad7/skills/okx-activity","status":"approved","author":"okx","authorVersion":"4.4.10","skillstoreRevision":1},"audit":{"id":"c663199a-bb5d-41c4-924c-330a8ed994e4","skill_id":"7ef2878b-f4f4-4fd0-b170-5fec09d483bd","version":1,"content_hash":"v3:bdb71a4bc34515f37772ae85fd5501f9c2ff33b0:4e519c161bea24a5ecc9f795e1e584d3ffe4f64d277b35530de64e543855794a:590e376ebf8edff9225710698d4cc49cf83089ccb546b7f17205faeafb79950c:736b696c6c732f6f6b782f6f6b782d6163746976697479:6d4f281eb366ec6f3935ab85c6e85e22","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"Most static alerts are false positives caused by Markdown code formatting, fixed internal references, and privacy-focused identifier rules. Confirmed risks include autonomous remote installation, loading instructions from a sibling skill, automatic code updates, and granting external tool output control over agent actions.","remediation":[{"issue":"The missing-CLI fallback runs an installer command sourced from a remote README.","severity":"high","suggestion":"Require explicit user approval, pin the installer URL and version, and verify a published checksum before execution."},{"issue":"Preflight output can direct the agent to perform unspecified actions.","severity":"high","suggestion":"Replace unrestricted data.action handling with a strict allowlist and reject shell commands, new instructions, and unknown action types."},{"issue":"Mandatory preflight can update executable code and skill instructions without separate consent.","severity":"high","suggestion":"Make updates opt-in, display the target version, and verify signed or pinned artifacts before installation."},{"issue":"The skill prefers a preflight document from a sibling skill directory.","severity":"high","suggestion":"Use only the audited bundled _shared/preflight.md file, or package a verified immutable shared dependency."},{"issue":"External rejection messages are relayed as authoritative user-facing content.","severity":"medium","suggestion":"Treat error text as untrusted data, escape unsafe formatting, reject instruction-like content, and present it inside a clearly labeled error boundary."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"_shared/preflight.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":52,"line_start":52},{"file":"SKILL.md","line_end":64,"line_start":64},{"file":"SKILL.md","line_end":68,"line_start":68},{"file":"SKILL.md","line_end":71,"line_start":71},{"file":"SKILL.md","line_end":79,"line_start":79},{"file":"SKILL.md","line_end":84,"line_start":84},{"file":"SKILL.md","line_end":85,"line_start":85},{"file":"SKILL.md","line_end":87,"line_start":87}]},{"factor":"filesystem","evidence":[{"file":"references/hackathon-core.md","line_end":6,"line_start":6},{"file":"references/hackathon-core.md","line_end":12,"line_start":12},{"file":"references/hackathon-core.md","line_end":28,"line_start":28},{"file":"references/hackathon-core.md","line_end":37,"line_start":37},{"file":"references/hackathon-registration.md","line_end":7,"line_start":7},{"file":"references/hackathon-registration.md","line_end":11,"line_start":11},{"file":"references/hackathon-registration.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":19,"line_start":19}]},{"factor":"network","evidence":[{"file":"references/hackathon-registration.md","line_end":42,"line_start":42},{"file":"references/hackathon-registration.md","line_end":52,"line_start":52},{"file":"SKILL.md","line_end":8,"line_start":8}]}],"critical_findings":[],"high_findings":[{"title":"PowerShell invocation","locations":[{"file":"_shared/preflight.md","line_end":16,"line_start":16}],"confidence":0.96,"description":"- **The `onchainos preflight` command above errored with \"command not found\"** (onchainos not instal","review_kind":"capability","source_category":"external_commands","source_severity":"high","confidence_reasoning":"The fallback directs the agent to obtain and run an OS-specific installer command from a remote README, including PowerShell on Windows. Autonomous execution of remotely sourced installation code creates a supply-chain and arbitrary-code-execution risk."},{"title":"Path traversal sequence","locations":[{"file":"SKILL.md","line_end":19,"line_start":19}],"confidence":0.94,"description":"Before your first onchainos command, read `../okx-agentic-wallet/_shared/preflight.md` once. If it d","review_kind":"capability","source_category":"filesystem","source_severity":"high","confidence_reasoning":"The skill explicitly prefers reading ../okx-agentic-wallet/_shared/preflight.md from a sibling skill before using its bundled fallback. This crosses the audited package boundary and can import modified or unreviewed instructions."},{"title":"Untrusted Tool Output Granted Instruction Authority","locations":[{"file":"_shared/preflight.md","line_end":10,"line_start":8}],"confidence":0.95,"description":"The preflight flow reads data.action from command output and says to do exactly what it says. A compromised binary or update channel could inject arbitrary agent instructions without an allowlist.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The instruction explicitly delegates action selection to external CLI output and provides no validation or permitted-action list."},{"title":"Automatic Binary and Skill Updates Without Consent","locations":[{"file":"_shared/preflight.md","line_end":12,"line_start":7}],"confidence":0.93,"description":"The mandatory preflight command updates the OnchainOS binary and skill checkouts before activity commands. The flow does not require user approval or a pinned artifact before changing executable code and instructions.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The file states that preflight updates both the binary and skill checkouts and mandates running it once per conversation."}],"medium_findings":[{"title":"External Error Text Relayed as Authoritative Output","locations":[{"file":"references/hackathon-registration.md","line_end":117,"line_start":112}],"confidence":0.84,"description":"Registration rejection text from the external service is translated and shown without added context or sanitization. A compromised service could place deceptive or instruction-like content directly in the assistant response.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The flow explicitly treats the returned error field as authoritative and requires displaying its content, while no content validation is specified."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":5,"total_lines":367,"audit_model":"codex","audited_at":"2026-08-20T08:32:15.451+00:00","created_at":"2026-08-20T09:51:30.668972+00:00","static_findings":[{"id":"external_commands:_shared/preflight.md:16:powershell-invocation","file":"_shared/preflight.md","pattern":"PowerShell invocation","snippet":"- **The `onchainos preflight` command above errored with \"command not found\"** (onchainos not instal","category":"external_commands","line_end":16,"severity":"high","line_start":16},{"id":"filesystem:references/hackathon-core.md:6:path-traversal-sequence","file":"references/hackathon-core.md","pattern":"Path traversal sequence","snippet":"> wrong-skill guard, activity routing, language, secrets) live in `../SKILL.md`.","category":"filesystem","line_end":6,"severity":"high","line_start":6},{"id":"filesystem:references/hackathon-core.md:12:path-traversal-sequence","file":"references/hackathon-core.md","pattern":"Path traversal sequence","snippet":"(`../SKILL.md` §Wrong-skill guard).","category":"filesystem","line_end":12,"severity":"high","line_start":12},{"id":"filesystem:references/hackathon-core.md:28:path-traversal-sequence","file":"references/hackathon-core.md","pattern":"Path traversal sequence","snippet":"flags; **learn exact syntax from the CLI, not from memory** (`../SKILL.md` §Command Index). The flag","category":"filesystem","line_end":28,"severity":"high","line_start":28},{"id":"filesystem:references/hackathon-core.md:37:path-traversal-sequence","file":"references/hackathon-core.md","pattern":"Path traversal sequence","snippet":"- [ ] **Gate A — Pre-flight** (**BLOCKING**) — `../SKILL.md` §Pre-flight Checks runs before the firs","category":"filesystem","line_end":37,"severity":"high","line_start":37},{"id":"blocker:references/hackathon-core.md:42:system-reconnaissance","file":"references/hackathon-core.md","pattern":"System reconnaissance","snippet":"- [ ] 1c. The submitted `agent_id` comes from this run's list output — never recalled, guessed, infe","category":"blocker","line_end":42,"severity":"low","line_start":42},{"id":"blocker:references/hackathon-core.md:52:system-reconnaissance","file":"references/hackathon-core.md","pattern":"System reconnaissance","snippet":"- The agent id MAY appear exactly once: in the numbered ASP-selection list ([hackathon-registration.","category":"blocker","line_end":52,"severity":"low","line_start":52},{"id":"blocker:references/hackathon-core.md:53:system-reconnaissance","file":"references/hackathon-core.md","pattern":"System reconnaissance","snippet":"- The OKX UID is a user identifier: the CLI never returns it, and when you echo the executed command","category":"blocker","line_end":53,"severity":"low","line_start":53},{"id":"blocker:references/hackathon-core.md:66:system-reconnaissance","file":"references/hackathon-core.md","pattern":"System reconnaissance","snippet":"- [ ] §Output Rules holds — activity id never shown, agent-id displayed at most once, UID masked","category":"blocker","line_end":66,"severity":"low","line_start":66},{"id":"blocker:references/hackathon-faq.md:11:system-reconnaissance","file":"references/hackathon-faq.md","pattern":"System reconnaissance","snippet":"A: X Layer, fixed by the CLI/MCP tool — no flag sets or returns it, and neither does the hackathon's","category":"blocker","line_end":11,"severity":"low","line_start":11},{"id":"network:references/hackathon-registration.md:42:hardcoded-url","file":"references/hackathon-registration.md","pattern":"Hardcoded URL","snippet":"Want a new trading ASP that meets the entry requirements instead? [See the tutorial](https://web3.ok","category":"network","line_end":42,"severity":"low","line_start":42},{"id":"network:references/hackathon-registration.md:52:hardcoded-url","file":"references/hackathon-registration.md","pattern":"Hardcoded URL","snippet":"You don’t have an ASP yet. Please create a trading ASP that meets the entry requirements first. [See","category":"network","line_end":52,"severity":"low","line_start":52},{"id":"filesystem:references/hackathon-registration.md:7:path-traversal-sequence","file":"references/hackathon-registration.md","pattern":"Path traversal sequence","snippet":"> Scope: the step-by-step registration flow and CLI/MCP reference for `hackathon register`. The hack","category":"filesystem","line_end":7,"severity":"high","line_start":7},{"id":"filesystem:references/hackathon-registration.md:11:path-traversal-sequence","file":"references/hackathon-registration.md","pattern":"Path traversal sequence","snippet":"Wallet login is required. If not logged in, route via `../SKILL.md` §Pre-flight Checks, then resume ","category":"filesystem","line_end":11,"severity":"high","line_start":11},{"id":"filesystem:references/hackathon-registration.md:26:path-traversal-sequence","file":"references/hackathon-registration.md","pattern":"Path traversal sequence","snippet":"- The projection printed `{\"error\": ...}` → that is the CLI's own failure envelope, not a listing. S","category":"filesystem","line_end":26,"severity":"high","line_start":26},{"id":"blocker:references/hackathon-registration.md:57:system-reconnaissance","file":"references/hackathon-registration.md","pattern":"System reconnaissance","snippet":"3. If the reply is `0`, or the user says they want to create one instead of picking a number: do **n","category":"blocker","line_end":57,"severity":"low","line_start":57},{"id":"blocker:references/hackathon-registration.md:84:system-reconnaissance","file":"references/hackathon-registration.md","pattern":"System reconnaissance","snippet":"2. cefi — Enter your OKX UID. For CeFi accounts, only USDT perpetual trading pairs will be counted. ","category":"blocker","line_end":84,"severity":"low","line_start":84},{"id":"blocker:references/hackathon-registration.md:92:system-reconnaissance","file":"references/hackathon-registration.md","pattern":"System reconnaissance","snippet":"- Reply `2` (cefi) → `--account-type cefi --uid <uid>`. Ask the user for their OKX UID. The X Layer ","category":"blocker","line_end":92,"severity":"low","line_start":92},{"id":"blocker:references/hackathon-registration.md:110:system-reconnaissance","file":"references/hackathon-registration.md","pattern":"System reconnaissance","snippet":"Output it verbatim (translated) — both numbered items and the closing paragraph, nothing dropped. Ad","category":"blocker","line_end":110,"severity":"low","line_start":110},{"id":"blocker:references/hackathon-registration.md:128:system-reconnaissance","file":"references/hackathon-registration.md","pattern":"System reconnaissance","snippet":"onchainos hackathon register --agent-id <id> --account-type <web3|cefi> [--address <addr>] [--uid <u","category":"blocker","line_end":128,"severity":"low","line_start":128},{"id":"blocker:references/hackathon-registration.md:133:system-reconnaissance","file":"references/hackathon-registration.md","pattern":"System reconnaissance","snippet":"| `--agent-id` | Yes | — | Trading ASP agent id (from `agent get-my-agents`). |","category":"blocker","line_end":133,"severity":"low","line_start":133},{"id":"blocker:references/hackathon-registration.md:136:system-reconnaissance","file":"references/hackathon-registration.md","pattern":"System reconnaissance","snippet":"| `--uid` | Conditional | — | OKX UID. **Required when `--account-type cefi`**, and **rejected when ","category":"blocker","line_end":136,"severity":"low","line_start":136},{"id":"blocker:references/hackathon-registration.md:138:system-reconnaissance","file":"references/hackathon-registration.md","pattern":"System reconnaissance","snippet":"The activity id and chain index (X Layer, `196`) are **fixed internally** — no flag or param sets, o","category":"blocker","line_end":138,"severity":"low","line_start":138},{"id":"blocker:references/hackathon-registration.md:143:system-reconnaissance","file":"references/hackathon-registration.md","pattern":"System reconnaissance","snippet":"- `--uid is required for CeFi account registration` → collect the UID and retry.","category":"blocker","line_end":143,"severity":"low","line_start":143},{"id":"blocker:references/hackathon-registration.md:144:system-reconnaissance","file":"references/hackathon-registration.md","pattern":"System reconnaissance","snippet":"- `--uid is only valid with --account-type cefi` → the user picked `web3` but a UID was passed; conf","category":"blocker","line_end":144,"severity":"low","line_start":144},{"id":"blocker:references/hackathon-registration.md:145:system-reconnaissance","file":"references/hackathon-registration.md","pattern":"System reconnaissance","snippet":"- `invalid account type ...` → `--account-type` was not exactly `web3` or `cefi`; re-send it lowerca","category":"blocker","line_end":145,"severity":"low","line_start":145},{"id":"blocker:references/hackathon-registration.md:146:system-reconnaissance","file":"references/hackathon-registration.md","pattern":"System reconnaissance","snippet":"- invalid `--address` for the chain → failed `validate_address_for_chain`; fix and retry.","category":"blocker","line_end":146,"severity":"low","line_start":146},{"id":"blocker:references/hackathon-registration.md:147:system-reconnaissance","file":"references/hackathon-registration.md","pattern":"System reconnaissance","snippet":"- `--agent-id is required` / `contains control characters` / `is too long` → the id was blank or man","category":"blocker","line_end":147,"severity":"low","line_start":147},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Each activity's flow, CLI reference, FAQ, and gates live in this skill's `references/` behind an","category":"external_commands","line_end":13,"severity":"medium","line_start":13},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`<activity>-*.md` prefix. This SKILL.md routes only — no templates, no CLI flags, no per-activity","category":"external_commands","line_end":14,"severity":"medium","line_start":14},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Before your first onchainos command, read `../okx-agentic-wallet/_shared/preflight.md` once. If it d","category":"external_commands","line_end":19,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**BLOCKING** — it runs before the first `onchainos` command of the session, for every activity, a","category":"external_commands","line_end":21,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Before producing ANY user-facing message about an activity, that activity's `*-core.md` must be","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"FAQ files do **not** repeat them, so opening a `-registration.md` / `-faq.md` first is not a","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"file, from memory, or from the CLI's `--help` output alone.","category":"external_commands","line_end":35,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"This skill drives `onchainos <activity>` subcommands (hackathon → `onchainos hackathon`). **Learn","category":"external_commands","line_end":43,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"exact syntax from the CLI, not from memory:** run `onchainos hackathon --help` for the subcommand","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"list, and `onchainos hackathon <subcommand> --help` for a subcommand's flags. Full parameter tables,","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"agent). `competition join` (`okx-growth-competition`) signs the **wallet account** up for a standard","category":"external_commands","line_end":52,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"subject as having pre-answered it. The full gate lives in the activity's `-registration.md`.","category":"external_commands","line_end":64,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"(`--uid <hidden>`) — they are never returned by the CLI and never pasted raw into the conversation.","category":"external_commands","line_end":68,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Creating an agent identity is never part of an activity flow — that is `okx-ai`. This skill only","category":"external_commands","line_end":71,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Each activity's `-core.md` owns its own gates, Output Rules, and Pre-Delivery Checklist; those are","category":"external_commands","line_end":79,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Add `references/<activity>-core.md` — its gates, reading order, output rules, and pre-delivery","category":"external_commands","line_end":84,"severity":"medium","line_start":84},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"checklist — plus `references/<activity>-*.md` for the flow and FAQ.","category":"external_commands","line_end":85,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. Extend this file's `description` with the new activity's triggers.","category":"external_commands","line_end":87,"severity":"medium","line_start":87},{"id":"network:SKILL.md:8:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"homepage: \"https://web3.okx.com\"","category":"network","line_end":8,"severity":"low","line_start":8},{"id":"filesystem:SKILL.md:19:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"Before your first onchainos command, read `../okx-agentic-wallet/_shared/preflight.md` once. If it d","category":"filesystem","line_end":19,"severity":"high","line_start":19},{"id":"blocker:SKILL.md:68:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"(`--uid <hidden>`) — they are never returned by the CLI and never pasted raw into the conversation.","category":"blocker","line_end":68,"severity":"low","line_start":68}],"finding_verdicts":[{"id":"external_commands:_shared/preflight.md:16:powershell-invocation","reason":"The fallback directs the agent to obtain and run an OS-specific installer command from a remote README, including PowerShell on Windows. Autonomous execution of remotely sourced installation code creates a supply-chain and arbitrary-code-execution risk.","verdict":"confirmed","severity":"high","confidence":0.96},{"id":"filesystem:references/hackathon-core.md:6:path-traversal-sequence","reason":"The sequence is a Markdown reference to ../SKILL.md, the parent skill document. It does not read user-controlled paths or escape the skill package.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/hackathon-core.md:12:path-traversal-sequence","reason":"This is an inline citation to the parent SKILL.md section. It is documentation navigation, not runtime path traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/hackathon-core.md:28:path-traversal-sequence","reason":"The parent-path text cites the skill command index. No filesystem operation or user-controlled path is present.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/hackathon-core.md:37:path-traversal-sequence","reason":"The path points to the package's own parent SKILL.md as part of a checklist. This is a fixed local reference, not arbitrary traversal.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/hackathon-core.md:42:system-reconnaissance","reason":"The line requires an agent identifier to come from the user's current authorized listing. It prevents guessing and does not perform host-system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/hackathon-core.md:52:system-reconnaissance","reason":"This is a privacy rule limiting display of an application-level agent identifier. It does not inspect system configuration or resources.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/hackathon-core.md:53:system-reconnaissance","reason":"The text requires masking an OKX UID in conversation output. It reduces data exposure and contains no reconnaissance behavior.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/hackathon-core.md:66:system-reconnaissance","reason":"This checklist verifies identifier masking and output limits. It does not enumerate host or network information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/hackathon-faq.md:11:system-reconnaissance","reason":"The FAQ explains a fixed chain choice and internal activity identifier policy. It does not request or discover system information.","verdict":"false_positive","confidence":0.98},{"id":"network:references/hackathon-registration.md:42:hardcoded-url","reason":"The URL is a visible HTTPS link to an OKX tutorial and is not fetched automatically. It is relevant to users who need to create an ASP.","verdict":"false_positive","confidence":0.97},{"id":"network:references/hackathon-registration.md:52:hardcoded-url","reason":"This repeats the visible official OKX tutorial link in the no-ASP response. No background request, secret transmission, or concealed destination is present.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:references/hackathon-registration.md:7:path-traversal-sequence","reason":"The fixed ../SKILL.md path references the parent document within the same skill package. It is not based on user input and does not escape the package.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/hackathon-registration.md:11:path-traversal-sequence","reason":"This is a documentation link back to the package's SKILL.md preflight section. It is not an arbitrary filesystem access.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/hackathon-registration.md:26:path-traversal-sequence","reason":"The sequence appears in a fixed reference to ../SKILL.md while describing error recovery. It does not construct or traverse a user-controlled path.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/hackathon-registration.md:57:system-reconnaissance","reason":"The line handles a legacy menu response and routes ASP creation to another skill. It does not gather system information.","verdict":"false_positive","confidence":0.97},{"id":"blocker:references/hackathon-registration.md:84:system-reconnaissance","reason":"The line explains the user-selected CeFi account option and requests an OKX UID for registration. This is declared business input, not host reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/hackathon-registration.md:92:system-reconnaissance","reason":"The UID is collected only after the user chooses CeFi registration and is submitted for that stated purpose. The text does not inspect the user's system.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/hackathon-registration.md:110:system-reconnaissance","reason":"This output rule prohibits exposing the agent name, chain, account type, and wallet address in the success message. It is privacy-preserving rather than reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/hackathon-registration.md:128:system-reconnaissance","reason":"The line documents the fixed syntax for the intended registration command. Its identifiers are explicit registration inputs, not discovered host details.","verdict":"false_positive","confidence":0.97},{"id":"blocker:references/hackathon-registration.md:133:system-reconnaissance","reason":"This parameter-table row documents an application-level agent identifier obtained from the user's authorized agent list. It does not probe the operating system.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/hackathon-registration.md:136:system-reconnaissance","reason":"The row states when a user-provided OKX UID is required. It describes expected registration data and no system discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/hackathon-registration.md:138:system-reconnaissance","reason":"The line documents fixed internal registration constants and explicitly says they cannot be set or returned. It does not perform reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/hackathon-registration.md:143:system-reconnaissance","reason":"This is error guidance for a missing CeFi UID supplied by the user. It contains no host or network enumeration.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/hackathon-registration.md:144:system-reconnaissance","reason":"The line explains a validation error caused by using a UID with the Web3 option. It does not collect system metadata.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/hackathon-registration.md:145:system-reconnaissance","reason":"This is input-normalization guidance for the account-type parameter. No reconnaissance action is requested.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/hackathon-registration.md:146:system-reconnaissance","reason":"The line describes correcting a registration address after validation failure. It does not enumerate addresses or inspect unrelated system state.","verdict":"false_positive","confidence":0.97},{"id":"blocker:references/hackathon-registration.md:147:system-reconnaissance","reason":"The instruction recovers a valid application agent ID from the authorized listing instead of guessing it. This is scoped business data retrieval, not system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","reason":"The backticks are Markdown delimiters around a directory name. There is no Ruby interpolation or shell execution syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","reason":"The backticks format a filename pattern in prose. They do not invoke a shell or interpreter.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"The backticks format fixed Markdown paths and are not executable syntax. The separate filesystem finding for this line covers the actual cross-skill path risk.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"The backticks mark the onchainos command name in prose. No shell backtick substitution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"The backticks format a reference-file glob. They are Markdown, not command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The tokens are filename suffixes shown as inline code. There is no executable expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The inline text names the CLI help flag. Markdown backticks do not execute it.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The line documents the onchainos command shape using Markdown inline code. It contains no shell command substitution or dynamic input.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The skill recommends a fixed, read-only help command, and the backticks only format it. There is no Ruby or shell backtick execution construct.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"This is another fixed help-command example in Markdown. The placeholder is constrained to a documented subcommand and is not evaluated through backtick substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"The backticks distinguish command and skill names in an intent-routing warning. No command is run on this line.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"The inline code names a reference-file suffix. It is not executable syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"The backticks show a masked command-line example to prevent UID exposure. They do not execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The inline token is another skill's name for routing purposes. It is not a shell expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The backticks format a documentation filename pattern. There is no interpreter invocation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"This maintainer instruction shows a literal file path in Markdown. It does not execute shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"The text is a literal filename glob formatted as inline code. No command execution is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"The backticks format a frontmatter field name in documentation. They are not Ruby or shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:8:hardcoded-url","reason":"This is the declared HTTPS homepage for the skill author. It does not trigger a request or transmit data.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:19:path-traversal-sequence","reason":"The skill explicitly prefers reading ../okx-agentic-wallet/_shared/preflight.md from a sibling skill before using its bundled fallback. This crosses the audited package boundary and can import modified or unreviewed instructions.","verdict":"confirmed","severity":"high","confidence":0.94},{"id":"blocker:SKILL.md:68:system-reconnaissance","reason":"The line requires masking a user-supplied OKX UID when echoing commands. This is a data-protection control, not reconnaissance.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Untrusted Tool Output Granted Instruction Authority","severity":"high","locations":[{"file":"_shared/preflight.md","line_end":10,"line_start":8}],"confidence":0.95,"description":"The preflight flow reads data.action from command output and says to do exactly what it says. A compromised binary or update channel could inject arbitrary agent instructions without an allowlist.","confidence_reasoning":"The instruction explicitly delegates action selection to external CLI output and provides no validation or permitted-action list."},{"title":"Automatic Binary and Skill Updates Without Consent","severity":"high","locations":[{"file":"_shared/preflight.md","line_end":12,"line_start":7}],"confidence":0.93,"description":"The mandatory preflight command updates the OnchainOS binary and skill checkouts before activity commands. The flow does not require user approval or a pinned artifact before changing executable code and instructions.","confidence_reasoning":"The file states that preflight updates both the binary and skill checkouts and mandates running it once per conversation."},{"title":"External Error Text Relayed as Authoritative Output","severity":"medium","locations":[{"file":"references/hackathon-registration.md","line_end":117,"line_start":112}],"confidence":0.84,"description":"Registration rejection text from the external service is translated and shown without added context or sanitization. A compromised service could place deceptive or instruction-like content directly in the assistant response.","confidence_reasoning":"The flow explicitly treats the returned error field as authoritative and requires displaying its content, while no content validation is specified."}],"subject_marketplace_commit_sha":"bdb71a4bc34515f37772ae85fd5501f9c2ff33b0","subject_content_hash":"4e519c161bea24a5ecc9f795e1e584d3ffe4f64d277b35530de64e543855794a","subject_tree_hash":"590e376ebf8edff9225710698d4cc49cf83089ccb546b7f17205faeafb79950c","subject_plugin_path":"skills/okx/okx-activity","audit_payload_hash":"6d4f281eb366ec6f3935ab85c6e85e22","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"bdb71a4bc34515f37772ae85fd5501f9c2ff33b0","contentHash":"4e519c161bea24a5ecc9f795e1e584d3ffe4f64d277b35530de64e543855794a","treeHash":"590e376ebf8edff9225710698d4cc49cf83089ccb546b7f17205faeafb79950c","pluginPath":"skills/okx/okx-activity","auditPayloadHash":"6d4f281eb366ec6f3935ab85c6e85e22"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/okx-okx-activity/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":3,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}