Habilidades okx-agentic-wallet

📦

okx-agentic-wallet

Name: okx-agentic-wallet
Author: okx

v4.6.6 Revisión del contenido r1 Riesgo alto 📁 Acceso al sistema de archivos⚙️ Comandos externos🌐 Acceso a red

Manage OKX Wallets and On-Chain Transactions

Managing wallets across chains requires careful address checks, fee review, and transaction tracking. This skill guides Onchain OS CLI workflows for holdings, transfers, swaps, bridges, and security checks.

Compatible con: Claude Codex Code(CC)

⚠️ 38 Deficiente

Maintain this Skill? Claim it ⚠️ 38 Deficiente

Detente y solicita confirmación antes de instalar.

Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "okx-agentic-wallet" from https://skillstore.io/skills/okx-okx-agentic-wallet.md and its manifest at https://skillstore.io/api/skills/okx-okx-agentic-wallet/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/okx-okx-agentic-wallet.md Manifest firmado GET /api/skills/okx-okx-agentic-wallet/manifest Lockfile firmado GET /api/skills/okx-okx-agentic-wallet/lockfile

Pruébalo

Usando "okx-agentic-wallet". Show my holdings without changing anything.

Resultado esperado:

Illustrative result: Active account: Primary.
Ethereum holdings: 0.20 ETH and 150 USDC.
No transactions were submitted.

Usando "okx-agentic-wallet". Compare bridge options but do not send funds.

Resultado esperado:

Illustrative comparison: Route A estimates 99.50 USDC received, with a 0.50 USDC bridge fee.
Route B estimates 99.20 USDC received, with a 0.80 USDC bridge fee.
Source-chain gas is additional. Quotes can change. No bridge transaction was submitted.

Usando "okx-agentic-wallet". The token security scan failed. What happens next?

Resultado esperado:

Token verification is unavailable. No safety conclusion can be drawn.
Pause the trade and retry the scan before authorizing execution.

Auditoría de seguridad

Riesgo alto

v1 • 28/10/2026 Abrir el informe versionado

All 116 static matches are false positives for the reported patterns: documentation formatting, wallet identifiers, protective secret references, and legitimate paths or URLs. Semantic review found failed-scan continuation, conflicting swap-block rules, returned-command execution without specified validation, and an unpinned preflight installer. No evidence found of credential exfiltration or audit-directed prompt injection; external CLI and backend implementations were not verified.

Archivos escaneados

3,264

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (4)

Alto

references/security.md:35

Swap Security Scans Fail Open

Swap token-scan failures automatically continue with a warning, and unsupported scan chains do not block. Trading can proceed without completed token-risk verification.

The swap exception explicitly removes the general retry-or-consent pause after scan failure. This creates a verification gap, not evidence of malicious intent.

Alto

references/swap.md:58 references/swap.md:106-120 SKILL.md:99-101

Conflicting Rules Permit Blocked Swap Overrides

The swap flow says blocked routes must not broadcast, but later rules say BLOCK requires an explicit override, including blacklisted addresses. This weakens mandatory stops.

Directly conflicting instructions distinguish neither overridable warnings nor immutable blocks. An agent can interpret later override guidance as authorization to trade blocked assets.

Alto

SKILL.md:80-86 references/bridge.md:82-89 references/bridge-cli-reference.md:92

Returned Command Strings Cross the Execution Boundary

The skill follows returned next commands and uses returned bridge-status commands verbatim. It specifies no command allowlist or argument validation before execution.

The execution instructions directly trust returned command strings despite declaring CLI output untrusted. Exploitation depends on influencing those fields; no injected payload was found.

Medio

SKILL.md:45-47

Mandatory Preflight Runs an Unpinned Installer

The required preflight delegates to an automatically approved npx installer without a package version. Registry-delivered code runs before wallet operations without separate installation consent.

The cited line mandates the linked preflight, which runs npx -y @okxweb3/onchainos-installer. Its skill-version argument does not pin the installer package.

Factores de riesgo

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/okx-okx-agentic-wallet/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/okx-okx-agentic-wallet/security.svg)](https://skillstore.io/skills/okx-okx-agentic-wallet?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/okx-okx-agentic-wallet?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/okx-okx-agentic-wallet/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/okx-okx-agentic-wallet.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

okx. (2026). okx-agentic-wallet security audit report (audit version 1) [Author version 4.6.6]. Skillstore. https://skillstore.io/skills/okx-okx-agentic-wallet/audits/1

Cita BibTeX

@techreport{okx-okx-okx-agentic-wallet-2026,
  author = {okx},
  title = {okx-agentic-wallet security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/okx-okx-agentic-wallet/audits/1},
  note = {Author version 4.6.6}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "okx-agentic-wallet security audit report (audit version 1)"
version: "4.6.6"
type: report
authors:
  - name: "okx"
date-released: "2026-10-28"
url: "https://skillstore.io/skills/okx-okx-agentic-wallet/audits/1"
identifiers:
  - type: other
    value: "skillstore:okx-okx-agentic-wallet:audit:1"
    description: "Skillstore immutable audit report identifier"

Comparar variantes

2 variantes instalables

Cada autor sigue siendo un skill instalable independiente. La variante recomendada se ordena según la evidencia de Skillstore.

Por qué esta variante es la primera

Mayor uso en Skillstore

Autor / fuente Puntuación de Skillstore Confianza de la evidencia Uso en Skillstore Actualizado

internet-court Recomendado

internet-court-okx-agentic-wallet

Puntuación de Skillstore 38

Confianza de la evidencia Medio

Uso en Skillstore 10

Actualizado

2026-09-09

okx Actual

okx-okx-agentic-wallet

Puntuación de Skillstore 38

Confianza de la evidencia Medio

Uso en Skillstore 1

Actualizado

2026-10-28

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

100

Mantenibilidad

Contenido

Comunidad

100

Cumplimiento de la especificación

Lo que puedes crear

Review Personal Wallet Holdings

Inspect account balances, receive addresses, and transaction history without requesting transfers or disclosing credentials.

Compare Swap and Bridge Routes

Review token identities, expected proceeds, fees, and route risks before deciding whether to authorize a transaction.

Inspect Transaction and Approval Risks

Check contract interactions, inspect token allowances, and prepare revocations with simulation and explicit confirmation.

Prueba estos prompts

Check Wallet Balances

Show my current wallet account and token balances. Use read-only queries. Do not transfer funds or reveal credentials.

Review a Token Transfer

Prepare a transfer of [amount] [token] on [chain] to [full recipient address]. Show fees and checks. Wait for confirmation before sending.

Compare Bridge Routes

Compare routes for [amount] [token] from [source chain] to [destination chain]. Show fees and minimum receipts. Do not execute.

Audit Approvals Before Revocation

Inspect token approvals for [public address] on [chain]. Explain flagged spenders and prepare bounded revocations. Stop if scans fail. Confirm each write separately.

Mejores prácticas

Use a limited-balance wallet and configure spending limits and destination allowlists through the official portal before authorizing transactions.
Verify full addresses, chain, token identity, fees, and slippage against fresh CLI output before confirming each write.
Pause when scans fail or return BLOCK. Validate returned commands against documented syntax instead of executing arbitrary response strings.

Evitar

Sharing seed phrases, private keys, API credentials, or session tokens in the conversation.
Treating transaction broadcast, request acceptance, or a funding notification as final settlement or renewed transfer authorization.
Using force flags on the first attempt, bypassing blocked verdicts, or assuming a failed scan means an asset is safe.

Preguntas frecuentes

Which AI tools can use this skill?

The report lists Claude, Codex, and Claude Code. Actual execution also requires compatible command access and the external Onchain OS CLI.

Does every operation require wallet login?

No. Public-address portfolio queries and security checks can work without login. Wallet writes and limit orders require an authenticated account.

Can the agent export my seed phrase?

No. Export is a user action in the official wallet application or extension. Never share the resulting phrase with the agent.

Will it ask before sending funds?

The main rules require explicit confirmation before writes. Automated modes require prior opt-in. Conflicting swap-block instructions remain an audit concern.

Are swaps and limit orders available on every chain?

No. Support varies by command and backend. Limit orders list Ethereum, BSC, X Layer, Solana, Base, and Arbitrum.

Does a completed security scan guarantee safety?

No. Results cover only the checks performed. Failed scans provide no verification, and some documented swap paths continue with warnings.