Compétences okx-agentic-wallet

📦

okx-agentic-wallet

Name: okx-agentic-wallet
Author: okx

v4.6.6 Révision du contenu r1 Risque élevé 📁 Accès au système de fichiers⚙️ Commandes externes🌐 Accès réseau

Manage OKX Wallets and On-Chain Transactions

Managing wallets across chains requires careful address checks, fee review, and transaction tracking. This skill guides Onchain OS CLI workflows for holdings, transfers, swaps, bridges, and security checks.

Prend en charge: Claude Codex Code(CC)

⚠️ 38 Médiocre

Maintain this Skill? Claim it ⚠️ 38 Médiocre

Arrêtez-vous et demandez confirmation avant l’installation.

Examinez le plan et obtenez le consentement explicite de l’utilisateur avant de modifier des fichiers.

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "okx-agentic-wallet" from https://skillstore.io/skills/okx-okx-agentic-wallet.md and its manifest at https://skillstore.io/api/skills/okx-okx-agentic-wallet/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/okx-okx-agentic-wallet.md manifest signé GET /api/skills/okx-okx-agentic-wallet/manifest lockfile signé GET /api/skills/okx-okx-agentic-wallet/lockfile

Tester

Utilisation de « okx-agentic-wallet ». Show my holdings without changing anything.

Résultat attendu:

Illustrative result: Active account: Primary.
Ethereum holdings: 0.20 ETH and 150 USDC.
No transactions were submitted.

Utilisation de « okx-agentic-wallet ». Compare bridge options but do not send funds.

Résultat attendu:

Illustrative comparison: Route A estimates 99.50 USDC received, with a 0.50 USDC bridge fee.
Route B estimates 99.20 USDC received, with a 0.80 USDC bridge fee.
Source-chain gas is additional. Quotes can change. No bridge transaction was submitted.

Utilisation de « okx-agentic-wallet ». The token security scan failed. What happens next?

Résultat attendu:

Token verification is unavailable. No safety conclusion can be drawn.
Pause the trade and retry the scan before authorizing execution.

Audit de sécurité

Risque élevé

v1 • 28/10/2026 Ouvrir le rapport versionné

All 116 static matches are false positives for the reported patterns: documentation formatting, wallet identifiers, protective secret references, and legitimate paths or URLs. Semantic review found failed-scan continuation, conflicting swap-block rules, returned-command execution without specified validation, and an unpinned preflight installer. No evidence found of credential exfiltration or audit-directed prompt injection; external CLI and backend implementations were not verified.

Fichiers analysés

3,264

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (4)

Élevé

references/security.md:35

Swap Security Scans Fail Open

Swap token-scan failures automatically continue with a warning, and unsupported scan chains do not block. Trading can proceed without completed token-risk verification.

The swap exception explicitly removes the general retry-or-consent pause after scan failure. This creates a verification gap, not evidence of malicious intent.

Élevé

references/swap.md:58 references/swap.md:106-120 SKILL.md:99-101

Conflicting Rules Permit Blocked Swap Overrides

The swap flow says blocked routes must not broadcast, but later rules say BLOCK requires an explicit override, including blacklisted addresses. This weakens mandatory stops.

Directly conflicting instructions distinguish neither overridable warnings nor immutable blocks. An agent can interpret later override guidance as authorization to trade blocked assets.

Élevé

SKILL.md:80-86 references/bridge.md:82-89 references/bridge-cli-reference.md:92

Returned Command Strings Cross the Execution Boundary

The skill follows returned next commands and uses returned bridge-status commands verbatim. It specifies no command allowlist or argument validation before execution.

The execution instructions directly trust returned command strings despite declaring CLI output untrusted. Exploitation depends on influencing those fields; no injected payload was found.

Moyen

SKILL.md:45-47

Mandatory Preflight Runs an Unpinned Installer

The required preflight delegates to an automatically approved npx installer without a package version. Registry-delivered code runs before wallet operations without separate installation consent.

The cited line mandates the linked preflight, which runs npx -y @okxweb3/onchainos-installer. Its skill-version argument does not pin the installer package.

Facteurs de risque

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/okx-okx-agentic-wallet/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/okx-okx-agentic-wallet/security.svg)](https://skillstore.io/skills/okx-okx-agentic-wallet?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/okx-okx-agentic-wallet?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/okx-okx-agentic-wallet/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/okx-okx-agentic-wallet.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

okx. (2026). okx-agentic-wallet security audit report (audit version 1) [Author version 4.6.6]. Skillstore. https://skillstore.io/skills/okx-okx-agentic-wallet/audits/1

Citation BibTeX

@techreport{okx-okx-okx-agentic-wallet-2026,
  author = {okx},
  title = {okx-agentic-wallet security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/okx-okx-agentic-wallet/audits/1},
  note = {Author version 4.6.6}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "okx-agentic-wallet security audit report (audit version 1)"
version: "4.6.6"
type: report
authors:
  - name: "okx"
date-released: "2026-10-28"
url: "https://skillstore.io/skills/okx-okx-agentic-wallet/audits/1"
identifiers:
  - type: other
    value: "skillstore:okx-okx-agentic-wallet:audit:1"
    description: "Skillstore immutable audit report identifier"

Comparer les variantes

2 variantes installables

Chaque auteur reste un skill installable distinct. La variante recommandée est classée selon les preuves Skillstore.

Pourquoi cette variante est première

Utilisation Skillstore plus élevée

Auteur / source Score Skillstore Niveau de confiance des preuves Utilisation Skillstore Mis à jour

internet-court Recommandé

internet-court-okx-agentic-wallet

Score Skillstore 38

Niveau de confiance des preuves Moyen

Utilisation Skillstore 10

Mis à jour

2026-09-09

okx Actuelle

okx-okx-agentic-wallet

Score Skillstore 38

Niveau de confiance des preuves Moyen

Utilisation Skillstore Inconnu

Mis à jour

2026-10-28

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

100

Maintenabilité

Contenu

Communauté

100

Conformité aux spécifications

Ce que vous pouvez créer

Review Personal Wallet Holdings

Inspect account balances, receive addresses, and transaction history without requesting transfers or disclosing credentials.

Compare Swap and Bridge Routes

Review token identities, expected proceeds, fees, and route risks before deciding whether to authorize a transaction.

Inspect Transaction and Approval Risks

Check contract interactions, inspect token allowances, and prepare revocations with simulation and explicit confirmation.

Essayez ces prompts

Check Wallet Balances

Show my current wallet account and token balances. Use read-only queries. Do not transfer funds or reveal credentials.

Review a Token Transfer

Prepare a transfer of [amount] [token] on [chain] to [full recipient address]. Show fees and checks. Wait for confirmation before sending.

Compare Bridge Routes

Compare routes for [amount] [token] from [source chain] to [destination chain]. Show fees and minimum receipts. Do not execute.

Audit Approvals Before Revocation

Inspect token approvals for [public address] on [chain]. Explain flagged spenders and prepare bounded revocations. Stop if scans fail. Confirm each write separately.

Bonnes pratiques

Use a limited-balance wallet and configure spending limits and destination allowlists through the official portal before authorizing transactions.
Verify full addresses, chain, token identity, fees, and slippage against fresh CLI output before confirming each write.
Pause when scans fail or return BLOCK. Validate returned commands against documented syntax instead of executing arbitrary response strings.

Éviter

Sharing seed phrases, private keys, API credentials, or session tokens in the conversation.
Treating transaction broadcast, request acceptance, or a funding notification as final settlement or renewed transfer authorization.
Using force flags on the first attempt, bypassing blocked verdicts, or assuming a failed scan means an asset is safe.

Foire aux questions

Which AI tools can use this skill?

The report lists Claude, Codex, and Claude Code. Actual execution also requires compatible command access and the external Onchain OS CLI.

Does every operation require wallet login?

No. Public-address portfolio queries and security checks can work without login. Wallet writes and limit orders require an authenticated account.

Can the agent export my seed phrase?

No. Export is a user action in the official wallet application or extension. Never share the resulting phrase with the agent.

Will it ask before sending funds?

The main rules require explicit confirmation before writes. Automated modes require prior opt-in. Conflicting swap-block instructions remain an audit concern.

Are swaps and limit orders available on every chain?

No. Support varies by command and backend. Limit orders list Ethereum, BSC, X Layer, Solana, Base, and Arbitrum.

Does a completed security scan guarantee safety?

No. Results cover only the checks performed. Failed scans provide no verification, and some documented swap paths continue with warnings.