📦

okx-guide

Name: okx-guide
Author: okx

v4.4.10 Revisión del contenido r1 Riesgo alto ⚙️ Comandos externos📁 Acceso al sistema de archivos🌐 Acceso a red

Explore Onchain OS and OKX.AI

New users need clear paths through Onchain OS, OKX.AI roles, and support. This skill classifies requests and routes users into focused guided flows.

Compatible con: Claude Codex Code(CC)

⚠️ 38 Deficiente

Detente y solicita confirmación antes de instalar.

Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "okx-guide" from https://skillstore.io/skills/okx-okx-guide.md and its manifest at https://skillstore.io/api/skills/okx-okx-guide/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/okx-okx-guide.md Manifest firmado GET /api/skills/okx-okx-guide/manifest Lockfile firmado GET /api/skills/okx-okx-guide/lockfile

Pruébalo

Usando "okx-guide". What can Onchain OS help me do?

Resultado esperado:

A localized welcome view explains wallet, trading, market, and payment workflows, then presents the available numbered choices.

Usando "okx-guide". What is the difference between an ASP and an Evaluator?

Resultado esperado:

An ASP offers agent services in the marketplace. An Evaluator reviews disputes and requires the platform-defined staking process.

Usando "okx-guide". I need to report a problem.

Resultado esperado:

The response directs the user to the OKX.AI Help Center and lists the steps for starting a support chat.

Auditoría de seguridad

Riesgo alto

v1 • 20/8/2026 Abrir el informe versionado

Most static findings are false positives caused by Markdown code spans, fixed relative links, and displayed URLs. Confirmed risks include automatic execution of mutable installation directives and loading hidden home-directory workflows, while semantic review also found unsupported earnings claims.

Archivos escaneados

694

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (2)

Alto

_shared/preflight.md:7-16

Mutable Preflight Directives Can Trigger Commands

The preflight flow says to do exactly what a returned action says, can force an upgrade, and fetches installation commands from a mutable README. A compromised CLI response or upstream document could cause unauthorized command execution.

The file explicitly mandates execution of returned actions and remote installation guidance without an allowlist, pinned artifact, or confirmation step.

Medio

references/intro.md:19-38

Unsupported Financial Outcome Claims

The role-selection copy promotes million-per-year outcomes, round-the-clock earnings, and steadier income while encouraging paid services and OKB staking. These claims can unduly influence financial decisions.

The cited user-facing template contains direct earnings claims and a staking prompt without substantiation or a nearby risk qualification.

Elementos de revisión de capacidades (12)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto

_shared/preflight.md:16

PowerShell invocation

- **The `onchainos preflight` command above errored with "command not found"** (onchainos not instal

The fallback directs the agent to fetch current installation instructions and run the matching shell or PowerShell command. This executes mutable remote guidance without showing a pinned command or requiring user approval.

Alto

references/how-to-play.md:54

Hidden file in home directory

- If the user came from picking the **Daily brief** option (option `4` in Variant A / option `3` in

The flow automatically loads and follows a mutable Markdown workflow under the user home directory. Unverified content in that file can introduce commands or instructions outside the audited skill.

Alto

references/how-to-play.md:55

Hidden file in home directory

- If the user came from picking any other **workflow pick** while logged out: automatically load the

The instruction loads a variable workflow file from the hidden Onchain OS directory and follows it automatically. This crosses the audited package boundary without an integrity check.

Alto

references/welcome.md:165

Hidden file in home directory

The menu routes directly to a mutable workflow in the hidden Onchain OS home directory. Following unaudited local Markdown can introduce unsafe instructions.

Alto

references/welcome.md:166

Hidden file in home directory

This second menu variant uses the same hidden home-directory workflow handoff. The file is outside the audited package and lacks integrity validation.

Alto

references/welcome.md:189

Hidden file in home directory

- **Logged-in user**: load `~/.onchainos/workflows/daily-brief.md` directly and follow it.

The instruction explicitly loads and follows the hidden daily-brief workflow for logged-in users. That is an intentional trust boundary crossing.

Alto

SKILL.md:17

Path traversal sequence

**MUST**: Run the shared preflight **only for the onboarding flow** (§1 → `references/how-to-play.md

The onboarding flow actively reads a preflight file outside this skill directory and follows its instructions. Although the path is fixed, the external file can change independently and alter privileged setup behavior.

Medio

references/how-to-play.md:54

Hidden file access

- If the user came from picking the **Daily brief** option (option `4` in Variant A / option `3` in

The line explicitly reads and follows a hidden home-directory workflow. The access is intentional and can expose the agent to mutable local instructions.

Medio

references/how-to-play.md:55

Hidden file access

- If the user came from picking any other **workflow pick** while logged out: automatically load the

The wildcard workflow handoff intentionally accesses hidden local files and executes their guidance. No canonical-path or integrity validation is specified.

Medio

references/welcome.md:165

Hidden file access

The route accesses a hidden local workflow without user confirmation or integrity verification. Its contents can change independently of this audit.

Medio

references/welcome.md:166

Hidden file access

The alternate menu route accesses the same unaudited hidden workflow. This is real filesystem behavior rather than displayed example text.

Medio

references/welcome.md:189

Hidden file access

- **Logged-in user**: load `~/.onchainos/workflows/daily-brief.md` directly and follow it.

The logged-in branch directs the agent to read and follow a hidden local Markdown file. No content validation or trust restriction is stated.

Factores de riesgo

⚙️ Comandos externos (7)

_shared/preflight.md:16 SKILL.md:17 SKILL.md:19 SKILL.md:20 SKILL.md:28 SKILL.md:29 SKILL.md:30

📁 Acceso al sistema de archivos (19)

references/ai-guide.md:47 references/how-to-play.md:54 references/how-to-play.md:55 references/how-to-play.md:54 references/how-to-play.md:55 references/registered-home.md:12 references/registered-home.md:49 references/registered-home.md:52 references/unregistered-role-selection.md:19 references/unregistered-role-selection.md:20 references/unregistered-role-selection.md:21 references/unregistered-role-selection.md:26 references/welcome.md:165 references/welcome.md:166 references/welcome.md:189 references/welcome.md:165 references/welcome.md:166 references/welcome.md:189 SKILL.md:17

🌐 Acceso a red (3)

references/ai-support.md:16 references/ai-support.md:22 SKILL.md:8

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/okx-okx-guide/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/okx-okx-guide/security.svg)](https://skillstore.io/skills/okx-okx-guide?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/okx-okx-guide?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/okx-okx-guide/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/okx-okx-guide.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

okx. (2026). okx-guide security audit report (audit version 1) [Author version 4.4.10]. Skillstore. https://skillstore.io/skills/okx-okx-guide/audits/1

Cita BibTeX

@techreport{okx-okx-okx-guide-2026,
  author = {okx},
  title = {okx-guide security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/okx-okx-guide/audits/1},
  note = {Author version 4.4.10}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "okx-guide security audit report (audit version 1)"
version: "4.4.10"
type: report
authors:
  - name: "okx"
date-released: "2026-08-20"
url: "https://skillstore.io/skills/okx-okx-guide/audits/1"
identifiers:
  - type: other
    value: "skillstore:okx-okx-guide:audit:1"
    description: "Skillstore immutable audit report identifier"

Comparar variantes

2 variantes instalables

Cada autor sigue siendo un skill instalable independiente. La variante recomendada se ordena según la evidencia de Skillstore.

Por qué esta variante es la primera

Mayor uso en Skillstore

Autor / fuente Puntuación de Skillstore Confianza de la evidencia Uso en Skillstore Actualizado

internet-court Recomendado

internet-court-okx-guide

Puntuación de Skillstore 38

Confianza de la evidencia Medio

Uso en Skillstore 6

Actualizado

2026-09-09

okx Actual

okx-okx-guide

Puntuación de Skillstore 38

Confianza de la evidencia Medio

Uso en Skillstore 2

Actualizado

2026-09-09

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

100

Mantenibilidad

Contenido

Comunidad

100

Cumplimiento de la especificación

Lo que puedes crear

Start with Onchain OS

Present the correct welcome view and route a first-time user toward a supported workflow.

Choose an OKX.AI Role

Explain User, ASP, and Evaluator roles before routing the selected registration flow.

Review Existing Agent Activity

Display registered identities and retrieve open tasks for a selected authenticated agent.

Prueba estos prompts

Get Started

Show me how to start using Onchain OS.

Understand OKX.AI Roles

Explain the User, ASP, and Evaluator roles in OKX.AI without starting registration.

Open My Agent Home

Show my registered OKX.AI identities and explain each status. Do not display signing addresses.

Review Agent Tasks

Retrieve open tasks for Agent ID [agent-id], group them by role, and identify tasks awaiting my review.

Mejores prácticas

State whether the user wants onboarding, role guidance, account information, or support.
Provide an Agent ID when requesting task details.
Review every command and financial action before approving it.